Merge commits '1b13415d 374e2b54 96294c00 8d2960c8 ce765a5b b2f6712d eedd7810 b327abfc 5d8fa825 3d05c86d bcffeb14 de657c20 060e32cb 0ba2b945 48b1d939 6b9507ad 5373693e 2e6cf9ba 6ee14550 26a98992 4d7fe609 ea26b71c 65c79fe2 727bec5b 0b4640ae 199d27ce cbf3053f 49be5be9 b10ddd2b 4fd00f4b ba9cb6f3 ee7aaf21 ' into temp-merge-1395

- Replace fe_equal_var with fe_equal - Use CHECK_ILLEGAL instead of CHECK/ecount - Turn on secp256k1-zkp specific modules in CI
2023-09-19 14:44:41 +00:00 · 2023-09-19 14:44:41 +00:00 · 775f5e242b
commit 775f5e242b
parent b911b3cbd5 ee7aaf213e
43 changed files with 2063 additions and 1996 deletions
--- a/.cirrus.yml
+++ b/.cirrus.yml
@ -1,462 +0,0 @@
 env:
  ### cirrus config
  CIRRUS_CLONE_DEPTH: 1
  ### compiler options
  HOST:
  WRAPPER_CMD:
  # Specific warnings can be disabled with -Wno-error=foo.
  # -pedantic-errors is not equivalent to -Werror=pedantic and thus not implied by -Werror according to the GCC manual.
  WERROR_CFLAGS: -Werror -pedantic-errors
  MAKEFLAGS: -j4
  BUILD: check
  ### secp256k1 config
  ECMULTWINDOW: auto
  ECMULTGENPRECISION: auto
  ASM: no
  WIDEMUL: auto
  WITH_VALGRIND: yes
  EXTRAFLAGS:
  ### secp256k1 modules
  EXPERIMENTAL: no
  ECDH: no
  RECOVERY: no
  SCHNORRSIG: no
  ELLSWIFT: no
  ECDSA_S2C: no
  GENERATOR: no
  RANGEPROOF: no
  WHITELIST: no
  MUSIG: no
  ECDSAADAPTOR: no
  BPPP: no
  ### test options
  SECP256K1_TEST_ITERS:
  BENCH: yes
  SECP256K1_BENCH_ITERS: 2
  CTIMETESTS: yes
  # Compile and run the tests
  EXAMPLES: yes
 # https://cirrus-ci.org/pricing/#compute-credits
 credits_snippet: &CREDITS
  # Don't use any credits for now.
  use_compute_credits: false
 cat_logs_snippet: &CAT_LOGS
  always:
    cat_tests_log_script:
      - cat tests.log || true
    cat_noverify_tests_log_script:
      - cat noverify_tests.log || true
    cat_exhaustive_tests_log_script:
      - cat exhaustive_tests.log || true
    cat_ctime_tests_log_script:
      - cat ctime_tests.log || true
    cat_bench_log_script:
      - cat bench.log || true
    cat_config_log_script:
      - cat config.log || true
    cat_test_env_script:
      - cat test_env.log || true
    cat_ci_env_script:
      - env
 linux_container_snippet: &LINUX_CONTAINER
  container:
    dockerfile: ci/linux-debian.Dockerfile
    # Reduce number of CPUs to be able to do more builds in parallel.
    cpu: 1
    # Gives us more CPUs for free if they're available.
    greedy: true
    # More than enough for our scripts.
    memory: 2G
 task:
  name: "x86_64: Linux (Debian stable)"
  << : *LINUX_CONTAINER
  matrix:
    - env: {WIDEMUL:  int64,  RECOVERY: yes}
    - env: {WIDEMUL:  int64,                 ECDH: yes, SCHNORRSIG: yes, ELLSWIFT: yes, EXPERIMENTAL: yes, ECDSA_S2C: yes,  RANGEPROOF: yes, WHITELIST: yes, GENERATOR: yes, MUSIG: yes, ECDSAADAPTOR: yes, BPPP: yes}
    - env: {WIDEMUL: int128}
    - env: {WIDEMUL: int128_struct}
    - env: {WIDEMUL: int128,  RECOVERY: yes,            SCHNORRSIG: yes, ELLSWIFT: yes}
    - env: {WIDEMUL: int128,                 ECDH: yes, SCHNORRSIG: yes, EXPERIMENTAL: yes, ECDSA_S2C: yes, RANGEPROOF: yes, WHITELIST: yes, GENERATOR: yes, MUSIG: yes, ECDSAADAPTOR: yes, BPPP: yes}
    - env: {WIDEMUL: int128,  ASM: x86_64                              , ELLSWIFT: yes}
    - env: {                  RECOVERY: yes,            SCHNORRSIG: yes, EXPERIMENTAL: yes, ECDSA_S2C: yes, RANGEPROOF: yes, WHITELIST: yes, GENERATOR: yes, MUSIG: yes, ECDSAADAPTOR: yes, BPPP: yes}
    - env: {CTIMETESTS: no,    RECOVERY: yes, ECDH: yes, SCHNORRSIG: yes, EXPERIMENTAL: yes, ECDSA_S2C: yes, RANGEPROOF: yes, WHITELIST: yes, GENERATOR: yes, MUSIG: yes, ECDSAADAPTOR: yes, BPPP: yes, CPPFLAGS: -DVERIFY}
    - env: {BUILD: distcheck, WITH_VALGRIND: no, CTIMETESTS: no, BENCH: no}
    - env: {CPPFLAGS: -DDETERMINISTIC}
    - env: {CFLAGS: -O0, CTIMETESTS: no}
    - env: {CFLAGS: -O1, RECOVERY: yes, ECDH: yes, SCHNORRSIG: yes, ELLSWIFT: yes}
    - env: { ECMULTGENPRECISION: 2, ECMULTWINDOW: 2 }
    - env: { ECMULTGENPRECISION: 8, ECMULTWINDOW: 4 }
  matrix:
    - env:
        CC: gcc
    - env:
        CC: clang
    - env:
        CC: gcc-snapshot
    - env:
        CC: clang-snapshot
  test_script:
    - ./ci/cirrus.sh
  << : *CAT_LOGS
 task:
  name: "i686: Linux (Debian stable)"
  << : *LINUX_CONTAINER
  env:
    HOST: i686-linux-gnu
    ECDH: yes
    RECOVERY: yes
    SCHNORRSIG: yes
    EXPERIMENTAL: yes
    ECDSA_S2C: yes
    RANGEPROOF: yes
    WHITELIST: yes
    GENERATOR: yes
    MUSIG: yes
    ECDSAADAPTOR: yes
    BPPP: yes
  matrix:
    - env:
        CC: i686-linux-gnu-gcc
    - env:
        CC: clang --target=i686-pc-linux-gnu -isystem /usr/i686-linux-gnu/include
  test_script:
    - ./ci/cirrus.sh
  << : *CAT_LOGS
 task:
  name: "arm64: macOS Ventura"
  macos_instance:
    image: ghcr.io/cirruslabs/macos-ventura-base:latest
  # tasks with valgrind enabled take about 90 minutes
  timeout_in: 120m
  env:
    HOMEBREW_NO_AUTO_UPDATE: 1
    HOMEBREW_NO_INSTALL_CLEANUP: 1
    # Cirrus gives us a fixed number of 4 virtual CPUs. Not that we even have that many jobs at the moment...
    MAKEFLAGS: -j5
  env:
    ASM: no
    WITH_VALGRIND: no
    CTIMETESTS: no
    CC: clang
  matrix:
    - env: {WIDEMUL:  int64,  RECOVERY: yes, ECDH: yes, SCHNORRSIG: yes, ELLSWIFT: yes}
    - env: {WIDEMUL:  int64,  RECOVERY: yes, ECDH: yes, SCHNORRSIG: yes, ELLSWIFT: yes, CC: gcc}
    - env: {WIDEMUL: int128_struct, ECMULTGENPRECISION: 2, ECMULTWINDOW: 4}
    - env: {WIDEMUL: int128,                 ECDH: yes, SCHNORRSIG: yes, ELLSWIFT: yes}
    - env: {WIDEMUL: int128,  RECOVERY: yes,            SCHNORRSIG: yes}
    - env: {WIDEMUL: int128,  RECOVERY: yes, ECDH: yes, SCHNORRSIG: yes, ELLSWIFT: yes, CC: gcc}
    - env: {WIDEMUL: int128,  RECOVERY: yes, ECDH: yes, SCHNORRSIG: yes, ELLSWIFT: yes, CPPFLAGS: -DVERIFY}
    - env: {BUILD: distcheck}
  brew_script:
    - brew install automake libtool gcc
  test_script:
    - ./ci/cirrus.sh
  << : *CAT_LOGS
  << : *CREDITS
 task:
  name: "s390x (big-endian): Linux (Debian stable, QEMU)"
  << : *LINUX_CONTAINER
  env:
    WRAPPER_CMD: qemu-s390x
    SECP256K1_TEST_ITERS: 16
    HOST: s390x-linux-gnu
    WITH_VALGRIND: no
    ECDH: yes
    RECOVERY: yes
    SCHNORRSIG: yes
    ELLSWIFT: yes
    EXPERIMENTAL: yes
    ECDSA_S2C: yes
    RANGEPROOF: yes
    WHITELIST: yes
    GENERATOR: yes
    MUSIG: yes
    ECDSAADAPTOR: yes
    BPPP: yes
    CTIMETESTS: no
  test_script:
    # https://sourceware.org/bugzilla/show_bug.cgi?id=27008
    - rm /etc/ld.so.cache
    - ./ci/cirrus.sh
  << : *CAT_LOGS
 task:
  name: "ARM32: Linux (Debian stable, QEMU)"
  << : *LINUX_CONTAINER
  env:
    WRAPPER_CMD: qemu-arm
    SECP256K1_TEST_ITERS: 16
    HOST: arm-linux-gnueabihf
    WITH_VALGRIND: no
    ECDH: yes
    RECOVERY: yes
    SCHNORRSIG: yes
    ELLSWIFT: yes
    CTIMETESTS: no
  matrix:
    - env: {}
    - env: {EXPERIMENTAL: yes, ASM: arm32}
  test_script:
    - ./ci/cirrus.sh
  << : *CAT_LOGS
 task:
  name: "ARM64: Linux (Debian stable, QEMU)"
  << : *LINUX_CONTAINER
  env:
    WRAPPER_CMD: qemu-aarch64
    SECP256K1_TEST_ITERS: 16
    HOST: aarch64-linux-gnu
    WITH_VALGRIND: no
    ECDH: yes
    RECOVERY: yes
    SCHNORRSIG: yes
    ELLSWIFT: yes
    CTIMETESTS: no
  test_script:
    - ./ci/cirrus.sh
  << : *CAT_LOGS
 task:
  name: "ppc64le: Linux (Debian stable, QEMU)"
  << : *LINUX_CONTAINER
  env:
    WRAPPER_CMD: qemu-ppc64le
    SECP256K1_TEST_ITERS: 16
    HOST: powerpc64le-linux-gnu
    WITH_VALGRIND: no
    ECDH: yes
    RECOVERY: yes
    SCHNORRSIG: yes
    ELLSWIFT: yes
    CTIMETESTS: no
  test_script:
    - ./ci/cirrus.sh
  << : *CAT_LOGS
 task:
  << : *LINUX_CONTAINER
  env:
    WRAPPER_CMD: wine
    WITH_VALGRIND: no
    ECDH: yes
    RECOVERY: yes
    SCHNORRSIG: yes
    CTIMETESTS: no
  matrix:
    - name: "x86_64 (mingw32-w64): Windows (Debian stable, Wine)"
      env:
        HOST: x86_64-w64-mingw32
    - name: "i686 (mingw32-w64): Windows (Debian stable, Wine)"
      env:
        HOST: i686-w64-mingw32
  test_script:
    - ./ci/cirrus.sh
  << : *CAT_LOGS
 task:
  << : *LINUX_CONTAINER
  env:
    WRAPPER_CMD: wine
    WERROR_CFLAGS: -WX
    WITH_VALGRIND: no
    ECDH: yes
    RECOVERY: yes
    EXPERIMENTAL: yes
    SCHNORRSIG: yes
    ELLSWIFT: yes
    ECDSA_S2C: yes
    GENERATOR: yes
    RANGEPROOF: yes
    WHITELIST: yes
    MUSIG: yes
    ECDSAADAPTOR: yes
    BPPP: yes
    CTIMETESTS: no
    # Use a MinGW-w64 host to tell ./configure we're building for Windows.
    # This will detect some MinGW-w64 tools but then make will need only
    # the MSVC tools CC, AR and NM as specified below.
    HOST: x86_64-w64-mingw32
    CC: /opt/msvc/bin/x64/cl
    AR: /opt/msvc/bin/x64/lib
    NM: /opt/msvc/bin/x64/dumpbin -symbols -headers
    # Set non-essential options that affect the CLI messages here.
    # (They depend on the user's taste, so we don't want to set them automatically in configure.ac.)
    CFLAGS: -nologo -diagnostics:caret
    LDFLAGS: -Xlinker -Xlinker -Xlinker -nologo
  matrix:
    - name: "x86_64 (MSVC): Windows (Debian stable, Wine)"
    - name: "x86_64 (MSVC): Windows (Debian stable, Wine, int128_struct)"
      env:
        WIDEMUL: int128_struct
    - name: "x86_64 (MSVC): Windows (Debian stable, Wine, int128_struct with __(u)mulh)"
      env:
        WIDEMUL: int128_struct
        CPPFLAGS: -DSECP256K1_MSVC_MULH_TEST_OVERRIDE
    - name: "i686 (MSVC): Windows (Debian stable, Wine)"
      env:
        HOST: i686-w64-mingw32
        CC: /opt/msvc/bin/x86/cl
        AR: /opt/msvc/bin/x86/lib
        NM: /opt/msvc/bin/x86/dumpbin -symbols -headers
  test_script:
    - ./ci/cirrus.sh
  << : *CAT_LOGS
 # Sanitizers
 task:
  timeout_in: 120m
  << : *LINUX_CONTAINER
  env:
    ECDH: yes
    RECOVERY: yes
    SCHNORRSIG: yes
    ELLSWIFT: yes
    EXPERIMENTAL: yes
    ECDSA_S2C: yes
    RANGEPROOF: yes
    WHITELIST: yes
    GENERATOR: yes
    MUSIG: yes
    ECDSAADAPTOR: yes
    BPPP: yes
    CTIMETESTS: no
  matrix:
    - name: "Valgrind (memcheck)"
      container:
        cpu: 2
      env:
        # The `--error-exitcode` is required to make the test fail if valgrind found errors, otherwise it'll return 0 (https://www.valgrind.org/docs/manual/manual-core.html)
        WRAPPER_CMD: "valgrind --error-exitcode=42"
        SECP256K1_TEST_ITERS: 2
    - name: "UBSan, ASan, LSan"
      container:
        memory: 2G
      env:
        CFLAGS: "-fsanitize=undefined,address -g"
        UBSAN_OPTIONS: "print_stacktrace=1:halt_on_error=1"
        ASAN_OPTIONS: "strict_string_checks=1:detect_stack_use_after_return=1:detect_leaks=1"
        LSAN_OPTIONS: "use_unaligned=1"
        SECP256K1_TEST_ITERS: 32
  # Try to cover many configurations with just a tiny matrix.
  matrix:
    - env:
        ASM: auto
    - env:
        ASM: no
        ECMULTGENPRECISION: 2
        ECMULTWINDOW: 2
  matrix:
    - env:
        CC: clang
    - env:
        HOST: i686-linux-gnu
        CC: i686-linux-gnu-gcc
  test_script:
    - ./ci/cirrus.sh
  << : *CAT_LOGS
 # Memory sanitizers
 task:
  << : *LINUX_CONTAINER
  name: "MSan"
  env:
    ECDH: yes
    RECOVERY: yes
    SCHNORRSIG: yes
    EXPERIMENTAL: yes
    ECDSA_S2C: yes
    GENERATOR: yes
    RANGEPROOF: yes
    WHITELIST: yes
    MUSIG: yes
    ECDSAADAPTOR: yes
    BPPP: yes
    CTIMETESTS: yes
    CC: clang
    SECP256K1_TEST_ITERS: 32
    ASM: no
    WITH_VALGRIND: no
  container:
    memory: 2G
  matrix:
    - env:
        CFLAGS: "-fsanitize=memory -g"
    - env:
        ECMULTGENPRECISION: 2
        ECMULTWINDOW: 2
        CFLAGS: "-fsanitize=memory -g -O3"
  test_script:
    - ./ci/cirrus.sh
  << : *CAT_LOGS
 task:
  name: "C++ -fpermissive (entire project)"
  << : *LINUX_CONTAINER
  env:
    CC: g++
    CFLAGS: -fpermissive -g
    CPPFLAGS: -DSECP256K1_CPLUSPLUS_TEST_OVERRIDE
    WERROR_CFLAGS:
    ECDH: yes
    RECOVERY: yes
    SCHNORRSIG: yes
    ELLSWIFT: yes
  test_script:
    - ./ci/cirrus.sh
  << : *CAT_LOGS
 task:
  name: "C++ (public headers)"
  << : *LINUX_CONTAINER
  test_script:
    - g++ -Werror include/*.h
    - clang -Werror -x c++-header include/*.h
    - /opt/msvc/bin/x64/cl.exe -c -WX -TP include/*.h
 task:
  name: "sage prover"
  << : *LINUX_CONTAINER
  test_script:
    - cd sage
    - sage prove_group_implementations.sage
 task:
  name: "x86_64: Windows (VS 2022)"
  windows_container:
    image: cirrusci/windowsservercore:visualstudio2022
    cpu: 4
    memory: 3840MB
  env:
    PATH: '%CIRRUS_WORKING_DIR%\build\src\RelWithDebInfo;%PATH%'
    x64_NATIVE_TOOLS: '"C:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools\VC\Auxiliary\Build\vcvars64.bat"'
    # Ignore MSBuild warning MSB8029.
    # See: https://learn.microsoft.com/en-us/visualstudio/msbuild/errors/msb8029?view=vs-2022
    IgnoreWarnIntDirInTempDetected: 'true'
  matrix:
    - env:
        BUILD_SHARED_LIBS: ON
    - env:
        BUILD_SHARED_LIBS: OFF
  git_show_script:
    # Print commit to allow reproducing the job outside of CI.
    - git show --no-patch
  configure_script:
    - '%x64_NATIVE_TOOLS%'
    - cmake -E env CFLAGS="/WX" cmake -A x64 -B build -DSECP256K1_ENABLE_MODULE_RECOVERY=ON -DSECP256K1_BUILD_EXAMPLES=ON -DBUILD_SHARED_LIBS=%BUILD_SHARED_LIBS%
  build_script:
    - '%x64_NATIVE_TOOLS%'
    - cmake --build build --config RelWithDebInfo -- -property:UseMultiToolTask=true;CL_MPcount=5
  check_script:
    - '%x64_NATIVE_TOOLS%'
    - ctest -C RelWithDebInfo --test-dir build -j 5
    - build\src\RelWithDebInfo\bench_ecmult.exe
    - build\src\RelWithDebInfo\bench_internal.exe
    - build\src\RelWithDebInfo\bench.exe
--- a/.github/actions/install-homebrew-valgrind/action.yml
+++ b/.github/actions/install-homebrew-valgrind/action.yml
@ -0,0 +1,33 @@
 name: "Install Valgrind"
 description: "Install Homebrew's Valgrind package and cache it."
 runs:
  using: "composite"
  steps:
    - run: |
        brew tap LouisBrunner/valgrind
        brew fetch --HEAD LouisBrunner/valgrind/valgrind
        echo "CI_HOMEBREW_CELLAR_VALGRIND=$(brew --cellar valgrind)" >> "$GITHUB_ENV"
      shell: bash
    - run: |
        sw_vers > valgrind_fingerprint
        brew --version >> valgrind_fingerprint
        git -C "$(brew --cache)/valgrind--git" rev-parse HEAD >> valgrind_fingerprint
        cat valgrind_fingerprint
      shell: bash
    - uses: actions/cache@v3
      id: cache
      with:
        path: ${{ env.CI_HOMEBREW_CELLAR_VALGRIND }}
        key: ${{ github.job }}-valgrind-${{ hashFiles('valgrind_fingerprint') }}
    - if: steps.cache.outputs.cache-hit != 'true'
      run: |
        brew install --HEAD LouisBrunner/valgrind/valgrind
      shell: bash
    - if: steps.cache.outputs.cache-hit == 'true'
      run: |
        brew link valgrind
      shell: bash
--- a/.github/actions/run-in-docker-action/action.yml
+++ b/.github/actions/run-in-docker-action/action.yml
@ -0,0 +1,49 @@
 name: 'Run in Docker with environment'
 description: 'Run a command in a Docker container, while passing explicitly set environment variables into the container.'
 inputs:
  dockerfile:
    description: 'A Dockerfile that defines an image'
    required: true
  tag:
    description: 'A tag of an image'
    required: true
  command:
    description: 'A command to run in a container'
    required: false
    default: ./ci/ci.sh
 runs:
  using: "composite"
  steps:
    - uses: docker/setup-buildx-action@v3
    - uses: docker/build-push-action@v5
      id: main_builder
      continue-on-error: true
      with:
        context: .
        file: ${{ inputs.dockerfile }}
        tags: ${{ inputs.tag }}
        load: true
        cache-from: type=gha
    - uses: docker/build-push-action@v5
      id: retry_builder
      if: steps.main_builder.outcome == 'failure'
      with:
        context: .
        file: ${{ inputs.dockerfile }}
        tags: ${{ inputs.tag }}
        load: true
        cache-from: type=gha
    - # Tell Docker to pass environment variables in `env` into the container.
      run: >
        docker run \
          $(echo '${{ toJSON(env) }}' | jq -r 'keys[] | "--env \(.) "') \
          --volume ${{ github.workspace }}:${{ github.workspace }} \
          --workdir ${{ github.workspace }} \
          ${{ inputs.tag }} bash -c "
            git config --global --add safe.directory ${{ github.workspace }}
            ${{ inputs.command }}
          "
      shell: bash
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@ -0,0 +1,893 @@
 name: CI
 on:
  pull_request:
  push:
    branches:
      - '**'
    tags-ignore:
      - '**'
 concurrency:
  group: ${{ github.event_name != 'pull_request' && github.run_id || github.ref }}
  cancel-in-progress: true
 env:
  ### compiler options
  HOST:
  WRAPPER_CMD:
  # Specific warnings can be disabled with -Wno-error=foo.
  # -pedantic-errors is not equivalent to -Werror=pedantic and thus not implied by -Werror according to the GCC manual.
  WERROR_CFLAGS: '-Werror -pedantic-errors'
  MAKEFLAGS: '-j4'
  BUILD: 'check'
  ### secp256k1 config
  ECMULTWINDOW: 'auto'
  ECMULTGENPRECISION: 'auto'
  ASM: 'no'
  WIDEMUL: 'auto'
  WITH_VALGRIND: 'yes'
  EXTRAFLAGS:
  ### secp256k1 modules
  EXPERIMENTAL: 'no'
  ECDH: 'no'
  RECOVERY: 'no'
  SCHNORRSIG: 'no'
  ELLSWIFT: 'no'
  ECDSA_S2C: 'no'
  GENERATOR: 'no'
  RANGEPROOF: 'no'
  WHITELIST: 'no'
  MUSIG: 'no'
  ECDSAADAPTOR: 'no'
  BPPP: 'no'
  ### test options
  SECP256K1_TEST_ITERS:
  BENCH: 'yes'
  SECP256K1_BENCH_ITERS: 2
  CTIMETESTS: 'yes'
  # Compile and run the examples.
  EXAMPLES: 'yes'
 jobs:
  docker_cache:
    name: "Build Docker image"
    runs-on: ubuntu-latest
    steps:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          # See: https://github.com/moby/buildkit/issues/3969.
          driver-opts: |
            network=host
      - name: Build container
        uses: docker/build-push-action@v5
        with:
          file: ./ci/linux-debian.Dockerfile
          tags: linux-debian-image
          cache-from: type=gha
          cache-to: type=gha,mode=min
  linux_debian:
    name: "x86_64: Linux (Debian stable)"
    runs-on: ubuntu-latest
    needs: docker_cache
    strategy:
      fail-fast: false
      matrix:
        configuration:
          - env_vars: { WIDEMUL: 'int64',  RECOVERY: 'yes' }
          - env_vars: { WIDEMUL: 'int64',                   ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes', EXPERIMENTAL: 'yes', ECDSA_S2C: 'yes',  RANGEPROOF: 'yes', WHITELIST: 'yes', GENERATOR: 'yes', MUSIG: 'yes', ECDSAADAPTOR: 'yes', BPPP: 'yes' }
          - env_vars: { WIDEMUL: 'int128' }
          - env_vars: { WIDEMUL: 'int128_struct',                                           ELLSWIFT: 'yes' }
          - env_vars: { WIDEMUL: 'int128', RECOVERY: 'yes',              SCHNORRSIG: 'yes', ELLSWIFT: 'yes' }
          - env_vars: { WIDEMUL: 'int128',                  ECDH: 'yes', SCHNORRSIG: 'yes', EXPERIMENTAL: 'yes', ECDSA_S2C: 'yes', RANGEPROOF: 'yes', WHITELIST: 'yes', GENERATOR: 'yes', MUSIG: 'yes', ECDSAADAPTOR: 'yes', BPPP: 'yes'}
          - env_vars: { WIDEMUL: 'int128', ASM: 'x86_64',                                   ELLSWIFT: 'yes' }
          - env_vars: {                    RECOVERY: 'yes',              SCHNORRSIG: 'yes', EXPERIMENTAL: 'yes', ECDSA_S2C: 'yes', RANGEPROOF: 'yes', WHITELIST: 'yes', GENERATOR: 'yes', MUSIG: 'yes', ECDSAADAPTOR: 'yes', BPPP: 'yes'}
          - env_vars: { CTIMETESTS: 'no',  RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', EXPERIMENTAL: 'yes', ECDSA_S2C: 'yes', RANGEPROOF: 'yes', WHITELIST: 'yes', GENERATOR: 'yes', MUSIG: 'yes', ECDSAADAPTOR: 'yes', BPPP: 'yes', CPPFLAGS: '-DVERIFY' }
          - env_vars: { BUILD: 'distcheck', WITH_VALGRIND: 'no', CTIMETESTS: 'no', BENCH: 'no' }
          - env_vars: { CPPFLAGS: '-DDETERMINISTIC' }
          - env_vars: { CFLAGS: '-O0', CTIMETESTS: 'no' }
          - env_vars: { CFLAGS: '-O1',     RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes' }
          - env_vars: { ECMULTGENPRECISION: 2, ECMULTWINDOW: 2 }
          - env_vars: { ECMULTGENPRECISION: 8, ECMULTWINDOW: 4 }
        cc:
          - 'gcc'
          - 'clang'
          - 'gcc-snapshot'
          - 'clang-snapshot'
    env:
      CC: ${{ matrix.cc }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: CI script
        env: ${{ matrix.configuration.env_vars }}
        uses: ./.github/actions/run-in-docker-action
        with:
          dockerfile: ./ci/linux-debian.Dockerfile
          tag: linux-debian-image
      - run: cat tests.log || true
        if: ${{ always() }}
      - run: cat noverify_tests.log || true
        if: ${{ always() }}
      - run: cat exhaustive_tests.log || true
        if: ${{ always() }}
      - run: cat ctime_tests.log || true
        if: ${{ always() }}
      - run: cat bench.log || true
        if: ${{ always() }}
      - run: cat config.log || true
        if: ${{ always() }}
      - run: cat test_env.log || true
        if: ${{ always() }}
      - name: CI env
        run: env
        if: ${{ always() }}
  i686_debian:
    name: "i686: Linux (Debian stable)"
    runs-on: ubuntu-latest
    needs: docker_cache
    strategy:
      fail-fast: false
      matrix:
        cc:
          - 'i686-linux-gnu-gcc'
          - 'clang --target=i686-pc-linux-gnu -isystem /usr/i686-linux-gnu/include'
    env:
      HOST: 'i686-linux-gnu'
      ECDH: 'yes'
      RECOVERY: 'yes'
      SCHNORRSIG: 'yes'
      ELLSWIFT: 'yes'
      EXPERIMENTAL: 'yes'
      ECDSA_S2C: 'yes'
      RANGEPROOF: 'yes'
      WHITELIST: 'yes'
      GENERATOR: 'yes'
      MUSIG: 'yes'
      ECDSAADAPTOR: 'yes'
      BPPP: 'yes'
      CC: ${{ matrix.cc }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: CI script
        uses: ./.github/actions/run-in-docker-action
        with:
          dockerfile: ./ci/linux-debian.Dockerfile
          tag: linux-debian-image
      - run: cat tests.log || true
        if: ${{ always() }}
      - run: cat noverify_tests.log || true
        if: ${{ always() }}
      - run: cat exhaustive_tests.log || true
        if: ${{ always() }}
      - run: cat ctime_tests.log || true
        if: ${{ always() }}
      - run: cat bench.log || true
        if: ${{ always() }}
      - run: cat config.log || true
        if: ${{ always() }}
      - run: cat test_env.log || true
        if: ${{ always() }}
      - name: CI env
        run: env
        if: ${{ always() }}
  s390x_debian:
    name: "s390x (big-endian): Linux (Debian stable, QEMU)"
    runs-on: ubuntu-latest
    needs: docker_cache
    env:
      WRAPPER_CMD: 'qemu-s390x'
      SECP256K1_TEST_ITERS: 16
      HOST: 's390x-linux-gnu'
      WITH_VALGRIND: 'no'
      ECDH: 'yes'
      RECOVERY: 'yes'
      SCHNORRSIG: 'yes'
      ELLSWIFT: 'yes'
      EXPERIMENTAL: 'yes'
      ECDSA_S2C: 'yes'
      RANGEPROOF: 'yes'
      WHITELIST: 'yes'
      GENERATOR: 'yes'
      MUSIG: 'yes'
      ECDSAADAPTOR: 'yes'
      BPPP: 'yes'
      CTIMETESTS: 'no'
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: CI script
        uses: ./.github/actions/run-in-docker-action
        with:
          dockerfile: ./ci/linux-debian.Dockerfile
          tag: linux-debian-image
      - run: cat tests.log || true
        if: ${{ always() }}
      - run: cat noverify_tests.log || true
        if: ${{ always() }}
      - run: cat exhaustive_tests.log || true
        if: ${{ always() }}
      - run: cat ctime_tests.log || true
        if: ${{ always() }}
      - run: cat bench.log || true
        if: ${{ always() }}
      - run: cat config.log || true
        if: ${{ always() }}
      - run: cat test_env.log || true
        if: ${{ always() }}
      - name: CI env
        run: env
        if: ${{ always() }}
  arm32_debian:
    name: "ARM32: Linux (Debian stable, QEMU)"
    runs-on: ubuntu-latest
    needs: docker_cache
    strategy:
      fail-fast: false
      matrix:
        configuration:
          - env_vars: {}
          - env_vars: { EXPERIMENTAL: 'yes', ASM: 'arm32' }
    env:
      WRAPPER_CMD: 'qemu-arm'
      SECP256K1_TEST_ITERS: 16
      HOST: 'arm-linux-gnueabihf'
      WITH_VALGRIND: 'no'
      ECDH: 'yes'
      RECOVERY: 'yes'
      SCHNORRSIG: 'yes'
      ELLSWIFT: 'yes'
      EXPERIMENTAL: 'yes'
      ECDSA_S2C: 'yes'
      GENERATOR: 'yes'
      RANGEPROOF: 'yes'
      WHITELIST: 'yes'
      MUSIG: 'yes'
      ECDSAADAPTOR: 'yes'
      BPPP: 'yes'
      CTIMETESTS: 'no'
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: CI script
        env: ${{ matrix.configuration.env_vars }}
        uses: ./.github/actions/run-in-docker-action
        with:
          dockerfile: ./ci/linux-debian.Dockerfile
          tag: linux-debian-image
      - run: cat tests.log || true
        if: ${{ always() }}
      - run: cat noverify_tests.log || true
        if: ${{ always() }}
      - run: cat exhaustive_tests.log || true
        if: ${{ always() }}
      - run: cat ctime_tests.log || true
        if: ${{ always() }}
      - run: cat bench.log || true
        if: ${{ always() }}
      - run: cat config.log || true
        if: ${{ always() }}
      - run: cat test_env.log || true
        if: ${{ always() }}
      - name: CI env
        run: env
        if: ${{ always() }}
  arm64_debian:
    name: "ARM64: Linux (Debian stable, QEMU)"
    runs-on: ubuntu-latest
    needs: docker_cache
    env:
      WRAPPER_CMD: 'qemu-aarch64'
      SECP256K1_TEST_ITERS: 16
      HOST: 'aarch64-linux-gnu'
      WITH_VALGRIND: 'no'
      ECDH: 'yes'
      RECOVERY: 'yes'
      SCHNORRSIG: 'yes'
      ELLSWIFT: 'yes'
      EXPERIMENTAL: 'yes'
      ECDSA_S2C: 'yes'
      GENERATOR: 'yes'
      RANGEPROOF: 'yes'
      WHITELIST: 'yes'
      MUSIG: 'yes'
      ECDSAADAPTOR: 'yes'
      BPPP: 'yes'
      CTIMETESTS: 'no'
    strategy:
      fail-fast: false
      matrix:
        configuration:
          - env_vars: { } # gcc
          - env_vars: # clang
              CC: 'clang --target=aarch64-linux-gnu'
          - env_vars: # clang-snapshot
              CC: 'clang-snapshot --target=aarch64-linux-gnu'
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: CI script
        env: ${{ matrix.configuration.env_vars }}
        uses: ./.github/actions/run-in-docker-action
        with:
          dockerfile: ./ci/linux-debian.Dockerfile
          tag: linux-debian-image
      - run: cat tests.log || true
        if: ${{ always() }}
      - run: cat noverify_tests.log || true
        if: ${{ always() }}
      - run: cat exhaustive_tests.log || true
        if: ${{ always() }}
      - run: cat ctime_tests.log || true
        if: ${{ always() }}
      - run: cat bench.log || true
        if: ${{ always() }}
      - run: cat config.log || true
        if: ${{ always() }}
      - run: cat test_env.log || true
        if: ${{ always() }}
      - name: CI env
        run: env
        if: ${{ always() }}
  ppc64le_debian:
    name: "ppc64le: Linux (Debian stable, QEMU)"
    runs-on: ubuntu-latest
    needs: docker_cache
    env:
      WRAPPER_CMD: 'qemu-ppc64le'
      SECP256K1_TEST_ITERS: 16
      HOST: 'powerpc64le-linux-gnu'
      WITH_VALGRIND: 'no'
      ECDH: 'yes'
      RECOVERY: 'yes'
      SCHNORRSIG: 'yes'
      ELLSWIFT: 'yes'
      EXPERIMENTAL: 'yes'
      ECDSA_S2C: 'yes'
      GENERATOR: 'yes'
      RANGEPROOF: 'yes'
      WHITELIST: 'yes'
      MUSIG: 'yes'
      ECDSAADAPTOR: 'yes'
      BPPP: 'yes'
      CTIMETESTS: 'no'
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: CI script
        uses: ./.github/actions/run-in-docker-action
        with:
          dockerfile: ./ci/linux-debian.Dockerfile
          tag: linux-debian-image
      - run: cat tests.log || true
        if: ${{ always() }}
      - run: cat noverify_tests.log || true
        if: ${{ always() }}
      - run: cat exhaustive_tests.log || true
        if: ${{ always() }}
      - run: cat ctime_tests.log || true
        if: ${{ always() }}
      - run: cat bench.log || true
        if: ${{ always() }}
      - run: cat config.log || true
        if: ${{ always() }}
      - run: cat test_env.log || true
        if: ${{ always() }}
      - name: CI env
        run: env
        if: ${{ always() }}
  valgrind_debian:
    name: "Valgrind (memcheck)"
    runs-on: ubuntu-latest
    needs: docker_cache
    strategy:
      fail-fast: false
      matrix:
        configuration:
          - env_vars: { CC: 'clang',                                      ASM: 'auto' }
          - env_vars: { CC: 'i686-linux-gnu-gcc', HOST: 'i686-linux-gnu', ASM: 'auto' }
          - env_vars: { CC: 'clang',                                      ASM: 'no', ECMULTGENPRECISION: 2, ECMULTWINDOW: 2 }
          - env_vars: { CC: 'i686-linux-gnu-gcc', HOST: 'i686-linux-gnu', ASM: 'no', ECMULTGENPRECISION: 2, ECMULTWINDOW: 2 }
    env:
      # The `--error-exitcode` is required to make the test fail if valgrind found errors,
      # otherwise it will return 0 (https://www.valgrind.org/docs/manual/manual-core.html).
      WRAPPER_CMD: 'valgrind --error-exitcode=42'
      ECDH: 'yes'
      RECOVERY: 'yes'
      SCHNORRSIG: 'yes'
      ELLSWIFT: 'yes'
      EXPERIMENTAL: 'yes'
      ECDSA_S2C: 'yes'
      GENERATOR: 'yes'
      RANGEPROOF: 'yes'
      WHITELIST: 'yes'
      MUSIG: 'yes'
      ECDSAADAPTOR: 'yes'
      BPPP: 'yes'
      CTIMETESTS: 'no'
      SECP256K1_TEST_ITERS: 2
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: CI script
        env: ${{ matrix.configuration.env_vars }}
        uses: ./.github/actions/run-in-docker-action
        with:
          dockerfile: ./ci/linux-debian.Dockerfile
          tag: linux-debian-image
      - run: cat tests.log || true
        if: ${{ always() }}
      - run: cat noverify_tests.log || true
        if: ${{ always() }}
      - run: cat exhaustive_tests.log || true
        if: ${{ always() }}
      - run: cat ctime_tests.log || true
        if: ${{ always() }}
      - run: cat bench.log || true
        if: ${{ always() }}
      - run: cat config.log || true
        if: ${{ always() }}
      - run: cat test_env.log || true
        if: ${{ always() }}
      - name: CI env
        run: env
        if: ${{ always() }}
  sanitizers_debian:
    name: "UBSan, ASan, LSan"
    runs-on: ubuntu-latest
    needs: docker_cache
    strategy:
      fail-fast: false
      matrix:
        configuration:
          - env_vars: { CC: 'clang',                                      ASM: 'auto' }
          - env_vars: { CC: 'i686-linux-gnu-gcc', HOST: 'i686-linux-gnu', ASM: 'auto' }
          - env_vars: { CC: 'clang',                                      ASM: 'no', ECMULTGENPRECISION: 2, ECMULTWINDOW: 2 }
          - env_vars: { CC: 'i686-linux-gnu-gcc', HOST: 'i686-linux-gnu', ASM: 'no', ECMULTGENPRECISION: 2, ECMULTWINDOW: 2 }
    env:
      ECDH: 'yes'
      RECOVERY: 'yes'
      SCHNORRSIG: 'yes'
      ELLSWIFT: 'yes'
      EXPERIMENTAL: 'yes'
      ECDSA_S2C: 'yes'
      GENERATOR: 'yes'
      RANGEPROOF: 'yes'
      WHITELIST: 'yes'
      MUSIG: 'yes'
      ECDSAADAPTOR: 'yes'
      BPPP: 'yes'
      CTIMETESTS: 'no'
      CFLAGS: '-fsanitize=undefined,address -g'
      UBSAN_OPTIONS: 'print_stacktrace=1:halt_on_error=1'
      ASAN_OPTIONS: 'strict_string_checks=1:detect_stack_use_after_return=1:detect_leaks=1'
      LSAN_OPTIONS: 'use_unaligned=1'
      SECP256K1_TEST_ITERS: 32
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: CI script
        env: ${{ matrix.configuration.env_vars }}
        uses: ./.github/actions/run-in-docker-action
        with:
          dockerfile: ./ci/linux-debian.Dockerfile
          tag: linux-debian-image
      - run: cat tests.log || true
        if: ${{ always() }}
      - run: cat noverify_tests.log || true
        if: ${{ always() }}
      - run: cat exhaustive_tests.log || true
        if: ${{ always() }}
      - run: cat ctime_tests.log || true
        if: ${{ always() }}
      - run: cat bench.log || true
        if: ${{ always() }}
      - run: cat config.log || true
        if: ${{ always() }}
      - run: cat test_env.log || true
        if: ${{ always() }}
      - name: CI env
        run: env
        if: ${{ always() }}
  msan_debian:
    name: "MSan"
    runs-on: ubuntu-latest
    needs: docker_cache
    strategy:
      fail-fast: false
      matrix:
        configuration:
          - env_vars:
              CFLAGS: '-fsanitize=memory -fsanitize-recover=memory -g'
          - env_vars:
              ECMULTGENPRECISION: 2
              ECMULTWINDOW: 2
              CFLAGS: '-fsanitize=memory -fsanitize-recover=memory -g -O3'
    env:
      ECDH: 'yes'
      RECOVERY: 'yes'
      SCHNORRSIG: 'yes'
      ELLSWIFT: 'yes'
      EXPERIMENTAL: 'yes'
      ECDSA_S2C: 'yes'
      GENERATOR: 'yes'
      RANGEPROOF: 'yes'
      WHITELIST: 'yes'
      MUSIG: 'yes'
      ECDSAADAPTOR: 'yes'
      BPPP: 'yes'
      CTIMETESTS: 'yes'
      CC: 'clang'
      SECP256K1_TEST_ITERS: 32
      ASM: 'no'
      WITH_VALGRIND: 'no'
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: CI script
        env: ${{ matrix.configuration.env_vars }}
        uses: ./.github/actions/run-in-docker-action
        with:
          dockerfile: ./ci/linux-debian.Dockerfile
          tag: linux-debian-image
      - run: cat tests.log || true
        if: ${{ always() }}
      - run: cat noverify_tests.log || true
        if: ${{ always() }}
      - run: cat exhaustive_tests.log || true
        if: ${{ always() }}
      - run: cat ctime_tests.log || true
        if: ${{ always() }}
      - run: cat bench.log || true
        if: ${{ always() }}
      - run: cat config.log || true
        if: ${{ always() }}
      - run: cat test_env.log || true
        if: ${{ always() }}
      - name: CI env
        run: env
        if: ${{ always() }}
  mingw_debian:
    name: ${{ matrix.configuration.job_name }}
    runs-on: ubuntu-latest
    needs: docker_cache
    env:
      WRAPPER_CMD: 'wine'
      WITH_VALGRIND: 'no'
      ECDH: 'yes'
      RECOVERY: 'yes'
      SCHNORRSIG: 'yes'
      ELLSWIFT: 'yes'
      EXPERIMENTAL: 'yes'
      ECDSA_S2C: 'yes'
      GENERATOR: 'yes'
      RANGEPROOF: 'yes'
      WHITELIST: 'yes'
      MUSIG: 'yes'
      ECDSAADAPTOR: 'yes'
      BPPP: 'yes'
      CTIMETESTS: 'no'
    strategy:
      fail-fast: false
      matrix:
        configuration:
          - job_name: 'x86_64 (mingw32-w64): Windows (Debian stable, Wine)'
            env_vars:
              HOST: 'x86_64-w64-mingw32'
          - job_name: 'i686 (mingw32-w64): Windows (Debian stable, Wine)'
            env_vars:
              HOST: 'i686-w64-mingw32'
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: CI script
        env: ${{ matrix.configuration.env_vars }}
        uses: ./.github/actions/run-in-docker-action
        with:
          dockerfile: ./ci/linux-debian.Dockerfile
          tag: linux-debian-image
      - run: cat tests.log || true
        if: ${{ always() }}
      - run: cat noverify_tests.log || true
        if: ${{ always() }}
      - run: cat exhaustive_tests.log || true
        if: ${{ always() }}
      - run: cat ctime_tests.log || true
        if: ${{ always() }}
      - run: cat bench.log || true
        if: ${{ always() }}
      - run: cat config.log || true
        if: ${{ always() }}
      - run: cat test_env.log || true
        if: ${{ always() }}
      - name: CI env
        run: env
        if: ${{ always() }}
  macos-native:
    name: "x86_64: macOS Monterey"
    # See: https://github.com/actions/runner-images#available-images.
    runs-on: macos-12 # Use M1 once available https://github.com/github/roadmap/issues/528
    env:
      CC: 'clang'
      HOMEBREW_NO_AUTO_UPDATE: 1
      HOMEBREW_NO_INSTALL_CLEANUP: 1
    strategy:
      fail-fast: false
      matrix:
        env_vars:
          - { WIDEMUL: 'int64',  RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes' }
          - { WIDEMUL: 'int128_struct', ECMULTGENPRECISION: 2, ECMULTWINDOW: 4 }
          - { WIDEMUL: 'int128',                  ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes' }
          - { WIDEMUL: 'int128', RECOVERY: 'yes' }
          - { WIDEMUL: 'int128', RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes' }
          - { WIDEMUL: 'int128', RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes', CC: 'gcc' }
          - { WIDEMUL: 'int128', RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes',            WRAPPER_CMD: 'valgrind --error-exitcode=42', SECP256K1_TEST_ITERS: 2 }
          - { WIDEMUL: 'int128', RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes', CC: 'gcc', WRAPPER_CMD: 'valgrind --error-exitcode=42', SECP256K1_TEST_ITERS: 2 }
          - { WIDEMUL: 'int128', RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes', CPPFLAGS: '-DVERIFY', CTIMETESTS: 'no' }
          - BUILD: 'distcheck'
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Install Homebrew packages
        run: |
          brew install automake libtool gcc
          ln -s $(brew --prefix gcc)/bin/gcc-?? /usr/local/bin/gcc
      - name: Install and cache Valgrind
        uses: ./.github/actions/install-homebrew-valgrind
      - name: CI script
        env: ${{ matrix.env_vars }}
        run: ./ci/ci.sh
      - run: cat tests.log || true
        if: ${{ always() }}
      - run: cat noverify_tests.log || true
        if: ${{ always() }}
      - run: cat exhaustive_tests.log || true
        if: ${{ always() }}
      - run: cat ctime_tests.log || true
        if: ${{ always() }}
      - run: cat bench.log || true
        if: ${{ always() }}
      - run: cat config.log || true
        if: ${{ always() }}
      - run: cat test_env.log || true
        if: ${{ always() }}
      - name: CI env
        run: env
        if: ${{ always() }}
  win64-native:
    name: ${{ matrix.configuration.job_name }}
    # See: https://github.com/actions/runner-images#available-images.
    runs-on: windows-2022
    strategy:
      fail-fast: false
      matrix:
        configuration:
          - job_name: 'x64 (MSVC): Windows (VS 2022, shared)'
            cmake_options: '-A x64 -DBUILD_SHARED_LIBS=ON'
          - job_name: 'x64 (MSVC): Windows (VS 2022, static)'
            cmake_options: '-A x64 -DBUILD_SHARED_LIBS=OFF'
          - job_name: 'x64 (MSVC): Windows (VS 2022, int128_struct)'
            cmake_options: '-A x64 -DSECP256K1_TEST_OVERRIDE_WIDE_MULTIPLY=int128_struct'
          - job_name: 'x64 (MSVC): Windows (VS 2022, int128_struct with __(u)mulh)'
            cmake_options: '-A x64 -DSECP256K1_TEST_OVERRIDE_WIDE_MULTIPLY=int128_struct'
            cpp_flags: '/DSECP256K1_MSVC_MULH_TEST_OVERRIDE'
          - job_name: 'x86 (MSVC): Windows (VS 2022)'
            cmake_options: '-A Win32'
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Generate buildsystem
        run: cmake -E env CFLAGS="/WX ${{ matrix.configuration.cpp_flags }}" cmake -B build -DSECP256K1_ENABLE_MODULE_RECOVERY=ON -DSECP256K1_BUILD_EXAMPLES=ON ${{ matrix.configuration.cmake_options }}
      - name: Build
        run: cmake --build build --config RelWithDebInfo -- /p:UseMultiToolTask=true /maxCpuCount
      - name: Binaries info
        # Use the bash shell included with Git for Windows.
        shell: bash
        run: |
          cd build/src/RelWithDebInfo && file *tests.exe bench*.exe libsecp256k1-*.dll || true
      - name: Check
        run: |
          ctest -C RelWithDebInfo --test-dir build -j ([int]$env:NUMBER_OF_PROCESSORS + 1)
          build\src\RelWithDebInfo\bench_ecmult.exe
          build\src\RelWithDebInfo\bench_internal.exe
          build\src\RelWithDebInfo\bench.exe
  win64-native-headers:
    name: "x64 (MSVC): C++ (public headers)"
    # See: https://github.com/actions/runner-images#available-images.
    runs-on: windows-2022
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Add cl.exe to PATH
        uses: ilammy/msvc-dev-cmd@v1
      - name: C++ (public headers)
        run: |
          cl.exe -c -WX -TP include/*.h
  cxx_fpermissive_debian:
    name: "C++ -fpermissive (entire project)"
    runs-on: ubuntu-latest
    needs: docker_cache
    env:
      CC: 'g++'
      CFLAGS: '-fpermissive -g'
      CPPFLAGS: '-DSECP256K1_CPLUSPLUS_TEST_OVERRIDE'
      WERROR_CFLAGS:
      ECDH: 'yes'
      RECOVERY: 'yes'
      SCHNORRSIG: 'yes'
      ELLSWIFT: 'yes'
      EXPERIMENTAL: 'yes'
      ECDSA_S2C: 'yes'
      GENERATOR: 'yes'
      RANGEPROOF: 'yes'
      WHITELIST: 'yes'
      MUSIG: 'yes'
      ECDSAADAPTOR: 'yes'
      BPPP: 'yes'
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: CI script
        uses: ./.github/actions/run-in-docker-action
        with:
          dockerfile: ./ci/linux-debian.Dockerfile
          tag: linux-debian-image
      - run: cat tests.log || true
        if: ${{ always() }}
      - run: cat noverify_tests.log || true
        if: ${{ always() }}
      - run: cat exhaustive_tests.log || true
        if: ${{ always() }}
      - run: cat ctime_tests.log || true
        if: ${{ always() }}
      - run: cat bench.log || true
        if: ${{ always() }}
      - run: cat config.log || true
        if: ${{ always() }}
      - run: cat test_env.log || true
        if: ${{ always() }}
      - name: CI env
        run: env
        if: ${{ always() }}
  cxx_headers_debian:
    name: "C++ (public headers)"
    runs-on: ubuntu-latest
    needs: docker_cache
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: CI script
        uses: ./.github/actions/run-in-docker-action
        with:
          dockerfile: ./ci/linux-debian.Dockerfile
          tag: linux-debian-image
          command: |
            g++ -Werror include/*.h
            clang -Werror -x c++-header include/*.h
  sage:
    name: "SageMath prover"
    runs-on: ubuntu-latest
    container:
      image: sagemath/sagemath:latest
      options: --user root
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: CI script
        run: |
          cd sage
          sage prove_group_implementations.sage
  release:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - run: ./autogen.sh && ./configure --enable-dev-mode && make distcheck
      - name: Check installation with Autotools
        env:
          CI_INSTALL: ${{ runner.temp }}/${{ github.run_id }}${{ github.action }}/install
        run: |
          ./autogen.sh && ./configure --prefix=${{ env.CI_INSTALL }} && make clean && make install && ls -RlAh ${{ env.CI_INSTALL }}
          gcc -o ecdsa examples/ecdsa.c $(PKG_CONFIG_PATH=${{ env.CI_INSTALL }}/lib/pkgconfig pkg-config --cflags --libs libsecp256k1) -Wl,-rpath,"${{ env.CI_INSTALL }}/lib" && ./ecdsa
      - name: Check installation with CMake
        env:
          CI_BUILD: ${{ runner.temp }}/${{ github.run_id }}${{ github.action }}/build
          CI_INSTALL: ${{ runner.temp }}/${{ github.run_id }}${{ github.action }}/install
        run: |
          cmake -B ${{ env.CI_BUILD }} -DCMAKE_INSTALL_PREFIX=${{ env.CI_INSTALL }} && cmake --build ${{ env.CI_BUILD }} --target install && ls -RlAh ${{ env.CI_INSTALL }}
          gcc -o ecdsa examples/ecdsa.c -I ${{ env.CI_INSTALL }}/include -L ${{ env.CI_INSTALL }}/lib*/ -l secp256k1 -Wl,-rpath,"${{ env.CI_INSTALL }}/lib",-rpath,"${{ env.CI_INSTALL }}/lib64" && ./ecdsa
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -10,16 +10,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 ## [0.4.0] - 2023-09-04
 #### Added
 - New module `ellswift` implements ElligatorSwift encoding for public keys and x-only Diffie-Hellman key exchange for them.
   ElligatorSwift permits representing secp256k1 public keys as 64-byte arrays which cannot be distinguished from uniformly random. See:
   - Header file `include/secp256k1_ellswift.h` which defines the new API.
   - Document `doc/ellswift.md` which explains the mathematical background of the scheme.
   - The [paper](https://eprint.iacr.org/2022/759) on which the scheme is based.
 - We now test the library with unreleased development snapshots of GCC and Clang. This gives us an early chance to catch miscompilations and constant-time issues introduced by the compiler (such as those that led to the previous two releases).
 #### Fixed
 - Fixed symbol visibility in Windows DLL builds, where three internal library symbols were wrongly exported.
 #### Changed
 - When consuming libsecp256k1 as a static library on Windows, the user must now define the `SECP256K1_STATIC` macro before including `secp256k1.h`.
 #### ABI Compatibility
 This release is backward compatible with the ABI of 0.3.0, 0.3.1, and 0.3.2. Symbol visibility is now believed to be handled properly on supported platforms and is now considered to be part of the ABI. Please report any improperly exported symbols as a bug.
 ## [0.3.2] - 2023-05-13
 We strongly recommend updating to 0.3.2 if you use or plan to use GCC >=13 to compile libsecp256k1. When in doubt, check the GCC version using `gcc -v`.
@ -100,7 +109,8 @@ This version was in fact never released.
 The number was given by the build system since the introduction of autotools in Jan 2014 (ea0fe5a5bf0c04f9cc955b2966b614f5f378c6f6).
 Therefore, this version number does not uniquely identify a set of source files.
-[unreleased]: https://github.com/bitcoin-core/secp256k1/compare/v0.3.2...HEAD
+[unreleased]: https://github.com/bitcoin-core/secp256k1/compare/v0.4.0...HEAD
 [0.4.0]: https://github.com/bitcoin-core/secp256k1/compare/v0.3.2...v0.4.0
 [0.3.2]: https://github.com/bitcoin-core/secp256k1/compare/v0.3.1...v0.3.2
 [0.3.1]: https://github.com/bitcoin-core/secp256k1/compare/v0.3.0...v0.3.1
 [0.3.0]: https://github.com/bitcoin-core/secp256k1/compare/v0.2.0...v0.3.0
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@ -11,7 +11,7 @@ project(libsecp256k1
  # The package (a.k.a. release) version is based on semantic versioning 2.0.0 of
  # the API. All changes in experimental modules are treated as
  # backwards-compatible and therefore at most increase the minor version.
-  VERSION 0.3.3
+  VERSION 0.4.1
  DESCRIPTION "Optimized C library for ECDSA signatures and secret/public key operations on curve secp256k1."
  HOMEPAGE_URL "https://github.com/bitcoin-core/secp256k1"
  LANGUAGES C
@ -34,9 +34,9 @@ endif()
 # https://www.gnu.org/software/libtool/manual/html_node/Updating-version-info.html
 # All changes in experimental modules are treated as if they don't affect the
 # interface and therefore only increase the revision.
-set(${PROJECT_NAME}_LIB_VERSION_CURRENT 2)
+set(${PROJECT_NAME}_LIB_VERSION_CURRENT 3)
-set(${PROJECT_NAME}_LIB_VERSION_REVISION 3)
+set(${PROJECT_NAME}_LIB_VERSION_REVISION 1)
-set(${PROJECT_NAME}_LIB_VERSION_AGE 0)
+set(${PROJECT_NAME}_LIB_VERSION_AGE 1)
 set(CMAKE_C_STANDARD 90)
 set(CMAKE_C_EXTENSIONS OFF)
--- a/Makefile.am
+++ b/Makefile.am
@ -48,6 +48,7 @@ noinst_HEADERS += src/precomputed_ecmult.h
 noinst_HEADERS += src/precomputed_ecmult_gen.h
 noinst_HEADERS += src/assumptions.h
 noinst_HEADERS += src/checkmem.h
 noinst_HEADERS += src/testutil.h
 noinst_HEADERS += src/util.h
 noinst_HEADERS += src/int128.h
 noinst_HEADERS += src/int128_impl.h
--- a/ci/cirrus.sh
+++ b/ci/cirrus.sh
@ -32,18 +32,15 @@ print_environment() {
 }
 print_environment
-# Start persistent wineserver if necessary.
+env >> test_env.log
-# This speeds up jobs with many invocations of wine (e.g., ./configure with MSVC) tremendously.
+
-case "$WRAPPER_CMD" in
+# If gcc is requested, assert that it's in fact gcc (and not some symlinked Apple clang).
-    *wine*)
+case "${CC:-undefined}" in
-        # Make sure to shutdown wineserver whenever we exit.
+    *gcc*)
-        trap "wineserver -k || true" EXIT INT HUP
+        $CC -v 2>&1 | grep -q "gcc version" || exit 1;
        wineserver -p
        ;;
 esac
 env >> test_env.log
 if [ -n "${CC+x}" ]; then
    # The MSVC compiler "cl" doesn't understand "-v"
    $CC -v || true
--- a/ci/linux-debian.Dockerfile
+++ b/ci/linux-debian.Dockerfile
@ -1,7 +1,18 @@
-FROM debian:stable
+FROM debian:stable-slim
 SHELL ["/bin/bash", "-c"]
 WORKDIR /root
 # A too high maximum number of file descriptors (with the default value
 # inherited from the docker host) can cause issues with some of our tools:
 #  - sanitizers hanging: https://github.com/google/sanitizers/issues/1662 
 #  - valgrind crashing: https://stackoverflow.com/a/75293014
 # This is not be a problem on our CI hosts, but developers who run the image
 # on their machines may run into this (e.g., on Arch Linux), so warn them.
 # (Note that .bashrc is only executed in interactive bash shells.)
 RUN echo 'if [[ $(ulimit -n) -gt 200000 ]]; then echo "WARNING: Very high value reported by \"ulimit -n\". Consider passing \"--ulimit nofile=32768\" to \"docker run\"."; fi' >> /root/.bashrc
 RUN dpkg --add-architecture i386 && \
    dpkg --add-architecture s390x && \
    dpkg --add-architecture armhf && \
@ -11,7 +22,7 @@ RUN dpkg --add-architecture i386 && \
 # dkpg-dev: to make pkg-config work in cross-builds
 # llvm: for llvm-symbolizer, which is used by clang's UBSan for symbolized stack traces
 RUN apt-get update && apt-get install --no-install-recommends -y \
-        git ca-certificates wget \
+        git ca-certificates \
        make automake libtool pkg-config dpkg-dev valgrind qemu-user \
        gcc clang llvm libclang-rt-dev libc6-dbg \
        g++ \
@ -22,13 +33,13 @@ RUN apt-get update && apt-get install --no-install-recommends -y \
        gcc-powerpc64le-linux-gnu libc6-dev-ppc64el-cross libc6-dbg:ppc64el \
        gcc-mingw-w64-x86-64-win32 wine64 wine \
        gcc-mingw-w64-i686-win32 wine32 \
-        sagemath
+        python3
 WORKDIR /root
 # Build and install gcc snapshot
 ARG GCC_SNAPSHOT_MAJOR=14
-RUN wget --progress=dot:giga --https-only --recursive --accept '*.tar.xz' --level 1 --no-directories "https://gcc.gnu.org/pub/gcc/snapshots/LATEST-${GCC_SNAPSHOT_MAJOR}" && \
+RUN apt-get update && apt-get install --no-install-recommends -y wget libgmp-dev libmpfr-dev libmpc-dev flex && \
    mkdir gcc && cd gcc && \
    wget --progress=dot:giga --https-only --recursive --accept '*.tar.xz' --level 1 --no-directories "https://gcc.gnu.org/pub/gcc/snapshots/LATEST-${GCC_SNAPSHOT_MAJOR}" && \
    wget "https://gcc.gnu.org/pub/gcc/snapshots/LATEST-${GCC_SNAPSHOT_MAJOR}/sha512.sum" && \
    sha512sum --check --ignore-missing sha512.sum && \
    # We should have downloaded exactly one tar.xz file
@ -36,40 +47,29 @@ RUN wget --progress=dot:giga --https-only --recursive --accept '*.tar.xz' --leve
    [[ $(ls *.tar.xz | wc -l) -eq "1" ]] && \
    tar xf *.tar.xz && \
    mkdir gcc-build && cd gcc-build && \
    apt-get update && apt-get install --no-install-recommends -y libgmp-dev libmpfr-dev libmpc-dev flex && \
    ../*/configure --prefix=/opt/gcc-snapshot --enable-languages=c --disable-bootstrap --disable-multilib --without-isl && \
    make -j $(nproc) && \
    make install && \
-    ln -s /opt/gcc-snapshot/bin/gcc /usr/bin/gcc-snapshot
+    cd ../.. && rm -rf gcc && \
    ln -s /opt/gcc-snapshot/bin/gcc /usr/bin/gcc-snapshot && \
    apt-get autoremove -y wget libgmp-dev libmpfr-dev libmpc-dev flex && \
    apt-get clean && rm -rf /var/lib/apt/lists/*
-# Install clang snapshot
+# Install clang snapshot, see https://apt.llvm.org/
-RUN wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc && \
+RUN \
    # Setup GPG keys of LLVM repository
    apt-get update && apt-get install --no-install-recommends -y wget && \
    wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc && \
    # Add repository for this Debian release
    . /etc/os-release && echo "deb http://apt.llvm.org/${VERSION_CODENAME} llvm-toolchain-${VERSION_CODENAME} main" >> /etc/apt/sources.list && \
-    # Install clang snapshot
+    apt-get update && \
-    apt-get update && apt-get install --no-install-recommends -y clang && \
+    # Determine the version number of the LLVM development branch
-    # Remove just the "clang" symlink again
+    LLVM_VERSION=$(apt-cache search --names-only '^clang-[0-9]+$' | sort -V | tail -1 | cut -f1 -d" " | cut -f2 -d"-" ) && \
-    apt-get remove -y clang && \
+    # Install
-    # We should have exactly two clang versions now
+    apt-get install --no-install-recommends -y "clang-${LLVM_VERSION}" && \
-    ls /usr/bin/clang* && \
+    # Create symlink
-    [[    $(ls /usr/bin/clang-?? | sort | wc -l) -eq "2" ]] && \
+    ln -s "/usr/bin/clang-${LLVM_VERSION}" /usr/bin/clang-snapshot && \
-    # Create symlinks for them
+    # Clean up
-    ln -s $(ls /usr/bin/clang-?? | sort | tail -1) /usr/bin/clang-snapshot && \
+    apt-get autoremove -y wget && \
-    ln -s $(ls /usr/bin/clang-?? | sort | head -1) /usr/bin/clang
+    apt-get clean && rm -rf /var/lib/apt/lists/*
 # The "wine" package provides a convenience wrapper that we need
 RUN apt-get update && apt-get install --no-install-recommends -y \
        git ca-certificates wine64 wine python3-simplejson python3-six msitools winbind procps && \
 # Workaround for `wine` package failure to employ the Debian alternatives system properly.
    ln -s /usr/lib/wine/wine64 /usr/bin/wine64 && \
 # Set of tools for using MSVC on Linux.
    git clone https://github.com/mstorsjo/msvc-wine && \
    mkdir /opt/msvc && \
    python3 msvc-wine/vsdownload.py --accept-license --dest /opt/msvc Microsoft.VisualStudio.Workload.VCTools && \
 # Since commit 2146cbfaf037e21de56c7157ec40bb6372860f51, the
 # msvc-wine effectively initializes the wine prefix when running
 # the install.sh script.
    msvc-wine/install.sh /opt/msvc && \
 # Wait until the wineserver process has exited before closing the session,
 # to avoid corrupting the wine prefix.
    while (ps -A | grep wineserver) > /dev/null; do sleep 1; done
--- a/cmake/GeneratePkgConfigFile.cmake
+++ b/cmake/GeneratePkgConfigFile.cmake
@ -0,0 +1,8 @@
 function(generate_pkg_config_file in_file)
  set(prefix ${CMAKE_INSTALL_PREFIX})
  set(exec_prefix \${prefix})
  set(libdir \${exec_prefix}/${CMAKE_INSTALL_LIBDIR})
  set(includedir \${prefix}/${CMAKE_INSTALL_INCLUDEDIR})
  set(PACKAGE_VERSION ${PROJECT_VERSION})
  configure_file(${in_file} ${PROJECT_NAME}.pc @ONLY)
 endfunction()
--- a/doc/release-process.md
+++ b/doc/release-process.md
@ -24,14 +24,14 @@ Perform these checks before creating a release:
 2. Check installation with autotools:
 ```shell
 dir=$(mktemp -d)
-./autogen.sh && ./configure --prefix=$dir && make clean && make install && ls -l $dir/include $dir/lib
+./autogen.sh && ./configure --prefix=$dir && make clean && make install && ls -RlAh $dir
 gcc -o ecdsa examples/ecdsa.c $(PKG_CONFIG_PATH=$dir/lib/pkgconfig pkg-config --cflags --libs libsecp256k1) -Wl,-rpath,"$dir/lib" && ./ecdsa
 ```
 3. Check installation with CMake:
 ```shell
 dir=$(mktemp -d)
 build=$(mktemp -d)
-cmake -B $build -DCMAKE_INSTALL_PREFIX=$dir && cmake --build $build --target install && ls -l $dir/include $dir/lib*
+cmake -B $build -DCMAKE_INSTALL_PREFIX=$dir && cmake --build $build --target install && ls -RlAh $dir
 gcc -o ecdsa examples/ecdsa.c -I $dir/include -L $dir/lib*/ -l secp256k1 -Wl,-rpath,"$dir/lib",-rpath,"$dir/lib64" && ./ecdsa
 ```
@ -41,7 +41,7 @@ gcc -o ecdsa examples/ecdsa.c -I $dir/include -L $dir/lib*/ -l secp256k1 -Wl,-rp
   * finalizes the release notes in [CHANGELOG.md](../CHANGELOG.md) by
       * adding a section for the release (make sure that the version number is a link to a diff between the previous and new version),
       * removing the `[Unreleased]` section header, and
-       * including an entry for `### ABI Compatibility` if it doesn't exist that mentions the library soname of the release,
+       * including an entry for `### ABI Compatibility` if it doesn't exist,
   * sets `_PKG_VERSION_IS_RELEASE` to `true` in `configure.ac`, and
   * if this is not a patch release
       * updates `_PKG_VERSION_*` and `_LIB_VERSION_*`  in `configure.ac` and
--- a/examples/CMakeLists.txt
+++ b/examples/CMakeLists.txt
@ -1,24 +1,30 @@
-add_library(example INTERFACE)
+function(add_example name)
-target_include_directories(example INTERFACE
+  set(target_name ${name}_example)
  add_executable(${target_name} ${name}.c)
  target_include_directories(${target_name} PRIVATE
    ${PROJECT_SOURCE_DIR}/include
-)
+  )
-target_link_libraries(example INTERFACE
+  target_link_libraries(${target_name}
    secp256k1
    $<$<PLATFORM_ID:Windows>:bcrypt>
-)
+  )
  set(test_name ${name}_example)
  add_test(NAME ${test_name} COMMAND ${target_name})
  if(BUILD_SHARED_LIBS AND MSVC)
    # The DLL must reside either in the same folder where the executable is
    # or somewhere in PATH. Using the latter option.
    set_tests_properties(${test_name} PROPERTIES
      ENVIRONMENT "PATH=$<TARGET_FILE_DIR:secp256k1>;$ENV{PATH}"
    )
  endif()
 endfunction()
-add_executable(ecdsa_example ecdsa.c)
+add_example(ecdsa)
 target_link_libraries(ecdsa_example example)
 add_test(NAME ecdsa_example COMMAND ecdsa_example)
 if(SECP256K1_ENABLE_MODULE_ECDH)
-  add_executable(ecdh_example ecdh.c)
+  add_example(ecdh)
  target_link_libraries(ecdh_example example)
  add_test(NAME ecdh_example COMMAND ecdh_example)
 endif()
 if(SECP256K1_ENABLE_MODULE_SCHNORRSIG)
-  add_executable(schnorr_example schnorr.c)
+  add_example(schnorr)
  target_link_libraries(schnorr_example example)
  add_test(NAME schnorr_example COMMAND schnorr_example)
 endif()
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@ -161,5 +161,13 @@ if(SECP256K1_INSTALL)
      ${CMAKE_CURRENT_BINARY_DIR}/${PROJECT_NAME}-config.cmake
      ${CMAKE_CURRENT_BINARY_DIR}/${PROJECT_NAME}-config-version.cmake
    DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/${PROJECT_NAME}
-)
+  )
  include(GeneratePkgConfigFile)
  generate_pkg_config_file(${PROJECT_SOURCE_DIR}/libsecp256k1.pc.in)
  install(
    FILES
      ${CMAKE_CURRENT_BINARY_DIR}/${PROJECT_NAME}.pc
    DESTINATION ${CMAKE_INSTALL_LIBDIR}/pkgconfig
  )
 endif()
--- a/src/bench_ecmult.c
+++ b/src/bench_ecmult.c
@ -244,7 +244,6 @@ static void generate_scalar(uint32_t num, secp256k1_scalar* scalar) {
 static void run_ecmult_multi_bench(bench_data* data, size_t count, int includes_g, int num_iters) {
    char str[32];
    static const secp256k1_scalar zero = SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 0);
    size_t iters = 1 + num_iters / count;
    size_t iter;
@ -262,7 +261,7 @@ static void run_ecmult_multi_bench(bench_data* data, size_t count, int includes_
            secp256k1_scalar_add(&total, &total, &tmp);
        }
        secp256k1_scalar_negate(&total, &total);
-        secp256k1_ecmult(&data->expected_output[iter], NULL, &zero, &total);
+        secp256k1_ecmult(&data->expected_output[iter], NULL, &secp256k1_scalar_zero, &total);
    }
    /* Run the benchmark. */
--- a/src/checkmem.h
+++ b/src/checkmem.h
@ -58,7 +58,14 @@
 #if !defined SECP256K1_CHECKMEM_ENABLED
 #  if defined VALGRIND
 #    include <stddef.h>
 #  if defined(__clang__) && defined(__APPLE__)
 #    pragma clang diagnostic push
 #    pragma clang diagnostic ignored "-Wreserved-identifier"
 #  endif
 #    include <valgrind/memcheck.h>
 #  if defined(__clang__) && defined(__APPLE__)
 #    pragma clang diagnostic pop
 #  endif
 #    define SECP256K1_CHECKMEM_ENABLED 1
 #    define SECP256K1_CHECKMEM_UNDEFINE(p, len) VALGRIND_MAKE_MEM_UNDEFINED((p), (len))
 #    define SECP256K1_CHECKMEM_DEFINE(p, len) VALGRIND_MAKE_MEM_DEFINED((p), (len))
--- a/src/ctime_tests.c
+++ b/src/ctime_tests.c
@ -208,6 +208,10 @@ static void run_tests(secp256k1_context *ctx, unsigned char *key) {
        SECP256K1_CHECKMEM_UNDEFINE(key, 32);
        SECP256K1_CHECKMEM_DEFINE(&ellswift, sizeof(ellswift));
        ret = secp256k1_ellswift_xdh(ctx, msg, ellswift, ellswift, key, i, secp256k1_ellswift_xdh_hash_function_bip324, NULL);
        SECP256K1_CHECKMEM_DEFINE(&ret, sizeof(ret));
        CHECK(ret == 1);
        SECP256K1_CHECKMEM_UNDEFINE(key, 32);
        SECP256K1_CHECKMEM_DEFINE(&ellswift, sizeof(ellswift));
        ret = secp256k1_ellswift_xdh(ctx, msg, ellswift, ellswift, key, i, secp256k1_ellswift_xdh_hash_function_prefix, (void *)prefix);
        SECP256K1_CHECKMEM_DEFINE(&ret, sizeof(ret));
--- a/src/field.h
+++ b/src/field.h
@ -176,12 +176,6 @@ static int secp256k1_fe_is_odd(const secp256k1_fe *a);
 */
 static int secp256k1_fe_equal(const secp256k1_fe *a, const secp256k1_fe *b);
 /** Determine whether two field elements are equal, without constant-time guarantee.
 *
 * Identical in behavior to secp256k1_fe_equal, but not constant time in either a or b.
 */
 static int secp256k1_fe_equal_var(const secp256k1_fe *a, const secp256k1_fe *b);
 /** Compare the values represented by 2 field elements, without constant-time guarantee.
 *
 * On input, a and b must be valid normalized field elements.
@ -352,4 +346,7 @@ static int secp256k1_fe_is_square_var(const secp256k1_fe *a);
 /** Check invariants on a field element (no-op unless VERIFY is enabled). */
 static void secp256k1_fe_verify(const secp256k1_fe *a);
 /** Check that magnitude of a is at most m (no-op unless VERIFY is enabled). */
 static void secp256k1_fe_verify_magnitude(const secp256k1_fe *a, int m);
 #endif /* SECP256K1_FIELD_H */
--- a/src/field_impl.h
+++ b/src/field_impl.h
@ -23,27 +23,14 @@ SECP256K1_INLINE static int secp256k1_fe_equal(const secp256k1_fe *a, const secp
 #ifdef VERIFY
    secp256k1_fe_verify(a);
    secp256k1_fe_verify(b);
-    VERIFY_CHECK(a->magnitude <= 1);
+    secp256k1_fe_verify_magnitude(a, 1);
-    VERIFY_CHECK(b->magnitude <= 31);
+    secp256k1_fe_verify_magnitude(b, 31);
 #endif
    secp256k1_fe_negate(&na, a, 1);
    secp256k1_fe_add(&na, b);
    return secp256k1_fe_normalizes_to_zero(&na);
 }
 SECP256K1_INLINE static int secp256k1_fe_equal_var(const secp256k1_fe *a, const secp256k1_fe *b) {
    secp256k1_fe na;
 #ifdef VERIFY
    secp256k1_fe_verify(a);
    secp256k1_fe_verify(b);
    VERIFY_CHECK(a->magnitude <= 1);
    VERIFY_CHECK(b->magnitude <= 31);
 #endif
    secp256k1_fe_negate(&na, a, 1);
    secp256k1_fe_add(&na, b);
    return secp256k1_fe_normalizes_to_zero_var(&na);
 }
 static int secp256k1_fe_sqrt(secp256k1_fe * SECP256K1_RESTRICT r, const secp256k1_fe * SECP256K1_RESTRICT a) {
    /** Given that p is congruent to 3 mod 4, we can compute the square root of
     *  a mod p as the (p+1)/4'th power of a.
@ -60,7 +47,7 @@ static int secp256k1_fe_sqrt(secp256k1_fe * SECP256K1_RESTRICT r, const secp256k
 #ifdef VERIFY
    VERIFY_CHECK(r != a);
    secp256k1_fe_verify(a);
-    VERIFY_CHECK(a->magnitude <= 8);
+    secp256k1_fe_verify_magnitude(a, 8);
 #endif
    /** The binary representation of (p + 1)/4 has 3 blocks of 1s, with lengths in
@ -151,7 +138,7 @@ static int secp256k1_fe_sqrt(secp256k1_fe * SECP256K1_RESTRICT r, const secp256k
    if (!ret) {
        secp256k1_fe_negate(&t1, &t1, 1);
        secp256k1_fe_normalize_var(&t1);
-        VERIFY_CHECK(secp256k1_fe_equal_var(&t1, a));
+        VERIFY_CHECK(secp256k1_fe_equal(&t1, a));
    }
 #endif
    return ret;
@ -159,19 +146,26 @@ static int secp256k1_fe_sqrt(secp256k1_fe * SECP256K1_RESTRICT r, const secp256k
 #ifndef VERIFY
 static void secp256k1_fe_verify(const secp256k1_fe *a) { (void)a; }
 static void secp256k1_fe_verify_magnitude(const secp256k1_fe *a, int m) { (void)a; (void)m; }
 #else
 static void secp256k1_fe_impl_verify(const secp256k1_fe *a);
 static void secp256k1_fe_verify(const secp256k1_fe *a) {
    /* Magnitude between 0 and 32. */
-    VERIFY_CHECK((a->magnitude >= 0) && (a->magnitude <= 32));
+    secp256k1_fe_verify_magnitude(a, 32);
    /* Normalized is 0 or 1. */
    VERIFY_CHECK((a->normalized == 0) || (a->normalized == 1));
    /* If normalized, magnitude must be 0 or 1. */
-    if (a->normalized) VERIFY_CHECK(a->magnitude <= 1);
+    if (a->normalized) secp256k1_fe_verify_magnitude(a, 1);
    /* Invoke implementation-specific checks. */
    secp256k1_fe_impl_verify(a);
 }
 static void secp256k1_fe_verify_magnitude(const secp256k1_fe *a, int m) {
    VERIFY_CHECK(m >= 0);
    VERIFY_CHECK(m <= 32);
    VERIFY_CHECK(a->magnitude <= m);
 }
 static void secp256k1_fe_impl_normalize(secp256k1_fe *r);
 SECP256K1_INLINE static void secp256k1_fe_normalize(secp256k1_fe *r) {
    secp256k1_fe_verify(r);
@ -293,7 +287,7 @@ static void secp256k1_fe_impl_negate_unchecked(secp256k1_fe *r, const secp256k1_
 SECP256K1_INLINE static void secp256k1_fe_negate_unchecked(secp256k1_fe *r, const secp256k1_fe *a, int m) {
    secp256k1_fe_verify(a);
    VERIFY_CHECK(m >= 0 && m <= 31);
-    VERIFY_CHECK(a->magnitude <= m);
+    secp256k1_fe_verify_magnitude(a, m);
    secp256k1_fe_impl_negate_unchecked(r, a, m);
    r->magnitude = m + 1;
    r->normalized = 0;
@ -326,8 +320,8 @@ static void secp256k1_fe_impl_mul(secp256k1_fe *r, const secp256k1_fe *a, const
 SECP256K1_INLINE static void secp256k1_fe_mul(secp256k1_fe *r, const secp256k1_fe *a, const secp256k1_fe * SECP256K1_RESTRICT b) {
    secp256k1_fe_verify(a);
    secp256k1_fe_verify(b);
-    VERIFY_CHECK(a->magnitude <= 8);
+    secp256k1_fe_verify_magnitude(a, 8);
-    VERIFY_CHECK(b->magnitude <= 8);
+    secp256k1_fe_verify_magnitude(b, 8);
    VERIFY_CHECK(r != b);
    VERIFY_CHECK(a != b);
    secp256k1_fe_impl_mul(r, a, b);
@ -339,7 +333,7 @@ SECP256K1_INLINE static void secp256k1_fe_mul(secp256k1_fe *r, const secp256k1_f
 static void secp256k1_fe_impl_sqr(secp256k1_fe *r, const secp256k1_fe *a);
 SECP256K1_INLINE static void secp256k1_fe_sqr(secp256k1_fe *r, const secp256k1_fe *a) {
    secp256k1_fe_verify(a);
-    VERIFY_CHECK(a->magnitude <= 8);
+    secp256k1_fe_verify_magnitude(a, 8);
    secp256k1_fe_impl_sqr(r, a);
    r->magnitude = 1;
    r->normalized = 0;
@ -418,7 +412,7 @@ SECP256K1_INLINE static void secp256k1_fe_get_bounds(secp256k1_fe* r, int m) {
 static void secp256k1_fe_impl_half(secp256k1_fe *r);
 SECP256K1_INLINE static void secp256k1_fe_half(secp256k1_fe *r) {
    secp256k1_fe_verify(r);
-    VERIFY_CHECK(r->magnitude < 32);
+    secp256k1_fe_verify_magnitude(r, 31);
    secp256k1_fe_impl_half(r);
    r->magnitude = (r->magnitude >> 1) + 1;
    r->normalized = 0;
--- a/src/group.h
+++ b/src/group.h
@ -44,6 +44,14 @@ typedef struct {
 #define SECP256K1_GE_STORAGE_CONST_GET(t) SECP256K1_FE_STORAGE_CONST_GET(t.x), SECP256K1_FE_STORAGE_CONST_GET(t.y)
 /** Maximum allowed magnitudes for group element coordinates
 *  in affine (x, y) and jacobian (x, y, z) representation. */
 #define SECP256K1_GE_X_MAGNITUDE_MAX  4
 #define SECP256K1_GE_Y_MAGNITUDE_MAX  3
 #define SECP256K1_GEJ_X_MAGNITUDE_MAX 4
 #define SECP256K1_GEJ_Y_MAGNITUDE_MAX 4
 #define SECP256K1_GEJ_Z_MAGNITUDE_MAX 1
 /** Set a group element equal to the point with given X and Y coordinates */
 static void secp256k1_ge_set_xy(secp256k1_ge *r, const secp256k1_fe *x, const secp256k1_fe *y);
--- a/src/group_impl.h
+++ b/src/group_impl.h
@ -77,6 +77,8 @@ static void secp256k1_ge_verify(const secp256k1_ge *a) {
 #ifdef VERIFY
    secp256k1_fe_verify(&a->x);
    secp256k1_fe_verify(&a->y);
    secp256k1_fe_verify_magnitude(&a->x, SECP256K1_GE_X_MAGNITUDE_MAX);
    secp256k1_fe_verify_magnitude(&a->y, SECP256K1_GE_Y_MAGNITUDE_MAX);
    VERIFY_CHECK(a->infinity == 0 || a->infinity == 1);
 #endif
    (void)a;
@ -87,6 +89,9 @@ static void secp256k1_gej_verify(const secp256k1_gej *a) {
    secp256k1_fe_verify(&a->x);
    secp256k1_fe_verify(&a->y);
    secp256k1_fe_verify(&a->z);
    secp256k1_fe_verify_magnitude(&a->x, SECP256K1_GEJ_X_MAGNITUDE_MAX);
    secp256k1_fe_verify_magnitude(&a->y, SECP256K1_GEJ_Y_MAGNITUDE_MAX);
    secp256k1_fe_verify_magnitude(&a->z, SECP256K1_GEJ_Z_MAGNITUDE_MAX);
    VERIFY_CHECK(a->infinity == 0 || a->infinity == 1);
 #endif
    (void)a;
@ -99,11 +104,13 @@ static void secp256k1_ge_set_gej_zinv(secp256k1_ge *r, const secp256k1_gej *a, c
    secp256k1_gej_verify(a);
    secp256k1_fe_verify(zi);
    VERIFY_CHECK(!a->infinity);
    secp256k1_fe_sqr(&zi2, zi);
    secp256k1_fe_mul(&zi3, &zi2, zi);
    secp256k1_fe_mul(&r->x, &a->x, &zi2);
    secp256k1_fe_mul(&r->y, &a->y, &zi3);
    r->infinity = a->infinity;
    secp256k1_ge_verify(r);
 }
@ -114,39 +121,47 @@ static void secp256k1_ge_set_ge_zinv(secp256k1_ge *r, const secp256k1_ge *a, con
    secp256k1_ge_verify(a);
    secp256k1_fe_verify(zi);
    VERIFY_CHECK(!a->infinity);
    secp256k1_fe_sqr(&zi2, zi);
    secp256k1_fe_mul(&zi3, &zi2, zi);
    secp256k1_fe_mul(&r->x, &a->x, &zi2);
    secp256k1_fe_mul(&r->y, &a->y, &zi3);
    r->infinity = a->infinity;
    secp256k1_ge_verify(r);
 }
 static void secp256k1_ge_set_xy(secp256k1_ge *r, const secp256k1_fe *x, const secp256k1_fe *y) {
    secp256k1_fe_verify(x);
    secp256k1_fe_verify(y);
    r->infinity = 0;
    r->x = *x;
    r->y = *y;
    secp256k1_ge_verify(r);
 }
 static int secp256k1_ge_is_infinity(const secp256k1_ge *a) {
    secp256k1_ge_verify(a);
    return a->infinity;
 }
 static void secp256k1_ge_neg(secp256k1_ge *r, const secp256k1_ge *a) {
    secp256k1_ge_verify(a);
    *r = *a;
    secp256k1_fe_normalize_weak(&r->y);
    secp256k1_fe_negate(&r->y, &r->y, 1);
    secp256k1_ge_verify(r);
 }
 static void secp256k1_ge_set_gej(secp256k1_ge *r, secp256k1_gej *a) {
    secp256k1_fe z2, z3;
    secp256k1_gej_verify(a);
    r->infinity = a->infinity;
    secp256k1_fe_inv(&a->z, &a->z);
    secp256k1_fe_sqr(&z2, &a->z);
@ -156,12 +171,15 @@ static void secp256k1_ge_set_gej(secp256k1_ge *r, secp256k1_gej *a) {
    secp256k1_fe_set_int(&a->z, 1);
    r->x = a->x;
    r->y = a->y;
    secp256k1_gej_verify(a);
    secp256k1_ge_verify(r);
 }
 static void secp256k1_ge_set_gej_var(secp256k1_ge *r, secp256k1_gej *a) {
    secp256k1_fe z2, z3;
    secp256k1_gej_verify(a);
    if (secp256k1_gej_is_infinity(a)) {
        secp256k1_ge_set_infinity(r);
        return;
@ -174,6 +192,8 @@ static void secp256k1_ge_set_gej_var(secp256k1_ge *r, secp256k1_gej *a) {
    secp256k1_fe_mul(&a->y, &a->y, &z3);
    secp256k1_fe_set_int(&a->z, 1);
    secp256k1_ge_set_xy(r, &a->x, &a->y);
    secp256k1_gej_verify(a);
    secp256k1_ge_verify(r);
 }
@ -181,9 +201,13 @@ static void secp256k1_ge_set_all_gej_var(secp256k1_ge *r, const secp256k1_gej *a
    secp256k1_fe u;
    size_t i;
    size_t last_i = SIZE_MAX;
-
+#ifdef VERIFY
    for (i = 0; i < len; i++) {
        secp256k1_gej_verify(&a[i]);
    }
 #endif
    for (i = 0; i < len; i++) {
        if (a[i].infinity) {
            secp256k1_ge_set_infinity(&r[i]);
        } else {
@ -217,36 +241,46 @@ static void secp256k1_ge_set_all_gej_var(secp256k1_ge *r, const secp256k1_gej *a
        if (!a[i].infinity) {
            secp256k1_ge_set_gej_zinv(&r[i], &a[i], &r[i].x);
        }
    }
 #ifdef VERIFY
    for (i = 0; i < len; i++) {
        secp256k1_ge_verify(&r[i]);
    }
 #endif
 }
 static void secp256k1_ge_table_set_globalz(size_t len, secp256k1_ge *a, const secp256k1_fe *zr) {
-    size_t i = len - 1;
+    size_t i;
    secp256k1_fe zs;
-
+#ifdef VERIFY
-    if (len > 0) {
+    for (i = 0; i < len; i++) {
        /* Verify inputs a[len-1] and zr[len-1]. */
        secp256k1_ge_verify(&a[i]);
        secp256k1_fe_verify(&zr[i]);
    }
 #endif
    if (len > 0) {
        i = len - 1;
        /* Ensure all y values are in weak normal form for fast negation of points */
        secp256k1_fe_normalize_weak(&a[i].y);
        zs = zr[i];
        /* Work our way backwards, using the z-ratios to scale the x/y values. */
        while (i > 0) {
            /* Verify all inputs a[i] and zr[i]. */
            secp256k1_fe_verify(&zr[i]);
            secp256k1_ge_verify(&a[i]);
            if (i != len - 1) {
                secp256k1_fe_mul(&zs, &zs, &zr[i]);
            }
            i--;
            secp256k1_ge_set_ge_zinv(&a[i], &a[i], &zs);
-            /* Verify the output a[i]. */
+        }
    }
 #ifdef VERIFY
    for (i = 0; i < len; i++) {
        secp256k1_ge_verify(&a[i]);
    }
-    }
+#endif
 }
 static void secp256k1_gej_set_infinity(secp256k1_gej *r) {
@ -254,6 +288,7 @@ static void secp256k1_gej_set_infinity(secp256k1_gej *r) {
    secp256k1_fe_clear(&r->x);
    secp256k1_fe_clear(&r->y);
    secp256k1_fe_clear(&r->z);
    secp256k1_gej_verify(r);
 }
@ -261,6 +296,7 @@ static void secp256k1_ge_set_infinity(secp256k1_ge *r) {
    r->infinity = 1;
    secp256k1_fe_clear(&r->x);
    secp256k1_fe_clear(&r->y);
    secp256k1_ge_verify(r);
 }
@ -269,17 +305,22 @@ static void secp256k1_gej_clear(secp256k1_gej *r) {
    secp256k1_fe_clear(&r->x);
    secp256k1_fe_clear(&r->y);
    secp256k1_fe_clear(&r->z);
    secp256k1_gej_verify(r);
 }
 static void secp256k1_ge_clear(secp256k1_ge *r) {
    r->infinity = 0;
    secp256k1_fe_clear(&r->x);
    secp256k1_fe_clear(&r->y);
    secp256k1_ge_verify(r);
 }
 static int secp256k1_ge_set_xquad(secp256k1_ge *r, const secp256k1_fe *x) {
    secp256k1_fe x2, x3;
    secp256k1_fe_verify(x);
    r->x = *x;
    secp256k1_fe_sqr(&x2, x);
    secp256k1_fe_mul(&x3, x, &x2);
@ -295,16 +336,19 @@ static int secp256k1_ge_set_xo_var(secp256k1_ge *r, const secp256k1_fe *x, int o
    if (secp256k1_fe_is_odd(&r->y) != odd) {
        secp256k1_fe_negate(&r->y, &r->y, 1);
    }
    secp256k1_ge_verify(r);
    return ret;
 }
 static void secp256k1_gej_set_ge(secp256k1_gej *r, const secp256k1_ge *a) {
   secp256k1_ge_verify(a);
   r->infinity = a->infinity;
   r->x = a->x;
   r->y = a->y;
   secp256k1_fe_set_int(&r->z, 1);
   secp256k1_gej_verify(r);
 }
@ -312,6 +356,7 @@ static int secp256k1_gej_eq_var(const secp256k1_gej *a, const secp256k1_gej *b)
    secp256k1_gej tmp;
    secp256k1_gej_verify(b);
    secp256k1_gej_verify(a);
    secp256k1_gej_neg(&tmp, a);
    secp256k1_gej_add_var(&tmp, &tmp, b, NULL);
    return secp256k1_gej_is_infinity(&tmp);
@ -319,37 +364,39 @@ static int secp256k1_gej_eq_var(const secp256k1_gej *a, const secp256k1_gej *b)
 static int secp256k1_gej_eq_x_var(const secp256k1_fe *x, const secp256k1_gej *a) {
    secp256k1_fe r;
 #ifdef VERIFY
    secp256k1_fe_verify(x);
    VERIFY_CHECK(a->x.magnitude <= 31);
    secp256k1_gej_verify(a);
 #ifdef VERIFY
    VERIFY_CHECK(!a->infinity);
 #endif
    secp256k1_fe_sqr(&r, &a->z); secp256k1_fe_mul(&r, &r, x);
-    return secp256k1_fe_equal_var(&r, &a->x);
+    return secp256k1_fe_equal(&r, &a->x);
 }
 static void secp256k1_gej_neg(secp256k1_gej *r, const secp256k1_gej *a) {
    secp256k1_gej_verify(a);
    r->infinity = a->infinity;
    r->x = a->x;
    r->y = a->y;
    r->z = a->z;
    secp256k1_fe_normalize_weak(&r->y);
    secp256k1_fe_negate(&r->y, &r->y, 1);
    secp256k1_gej_verify(r);
 }
 static int secp256k1_gej_is_infinity(const secp256k1_gej *a) {
    secp256k1_gej_verify(a);
    return a->infinity;
 }
 static int secp256k1_ge_is_valid_var(const secp256k1_ge *a) {
    secp256k1_fe y2, x3;
    secp256k1_ge_verify(a);
    if (a->infinity) {
        return 0;
    }
@ -357,14 +404,14 @@ static int secp256k1_ge_is_valid_var(const secp256k1_ge *a) {
    secp256k1_fe_sqr(&y2, &a->y);
    secp256k1_fe_sqr(&x3, &a->x); secp256k1_fe_mul(&x3, &x3, &a->x);
    secp256k1_fe_add_int(&x3, SECP256K1_B);
-    return secp256k1_fe_equal_var(&y2, &x3);
+    return secp256k1_fe_equal(&y2, &x3);
 }
 static SECP256K1_INLINE void secp256k1_gej_double(secp256k1_gej *r, const secp256k1_gej *a) {
    /* Operations: 3 mul, 4 sqr, 8 add/half/mul_int/negate */
    secp256k1_fe l, s, t;
    secp256k1_gej_verify(a);
    r->infinity = a->infinity;
    /* Formula used:
@ -391,10 +438,13 @@ static SECP256K1_INLINE void secp256k1_gej_double(secp256k1_gej *r, const secp25
    secp256k1_fe_mul(&r->y, &t, &l);       /* Y3 = L*(X3 + T) (1) */
    secp256k1_fe_add(&r->y, &s);           /* Y3 = L*(X3 + T) + S^2 (2) */
    secp256k1_fe_negate(&r->y, &r->y, 2);  /* Y3 = -(L*(X3 + T) + S^2) (3) */
    secp256k1_gej_verify(r);
 }
 static void secp256k1_gej_double_var(secp256k1_gej *r, const secp256k1_gej *a, secp256k1_fe *rzr) {
    secp256k1_gej_verify(a);
    /** For secp256k1, 2Q is infinity if and only if Q is infinity. This is because if 2Q = infinity,
     *  Q must equal -Q, or that Q.y == -(Q.y), or Q.y is 0. For a point on y^2 = x^3 + 7 to have
     *  y=0, x^3 must be -7 mod p. However, -7 has no cube root mod p.
@ -405,7 +455,6 @@ static void secp256k1_gej_double_var(secp256k1_gej *r, const secp256k1_gej *a, s
     *  the infinity flag even though the point doubles to infinity, and the result
     *  point will be gibberish (z = 0 but infinity = 0).
     */
    secp256k1_gej_verify(a);
    if (a->infinity) {
        secp256k1_gej_set_infinity(r);
        if (rzr != NULL) {
@ -420,15 +469,16 @@ static void secp256k1_gej_double_var(secp256k1_gej *r, const secp256k1_gej *a, s
    }
    secp256k1_gej_double(r, a);
    secp256k1_gej_verify(r);
 }
 static void secp256k1_gej_add_var(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_gej *b, secp256k1_fe *rzr) {
    /* 12 mul, 4 sqr, 11 add/negate/normalizes_to_zero (ignoring special cases) */
    secp256k1_fe z22, z12, u1, u2, s1, s2, h, i, h2, h3, t;
    secp256k1_gej_verify(a);
    secp256k1_gej_verify(b);
    if (a->infinity) {
        VERIFY_CHECK(rzr == NULL);
        *r = *b;
@ -483,14 +533,16 @@ static void secp256k1_gej_add_var(secp256k1_gej *r, const secp256k1_gej *a, cons
    secp256k1_fe_mul(&r->y, &t, &i);
    secp256k1_fe_mul(&h3, &h3, &s1);
    secp256k1_fe_add(&r->y, &h3);
    secp256k1_gej_verify(r);
 }
 static void secp256k1_gej_add_ge_var(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_ge *b, secp256k1_fe *rzr) {
-    /* 8 mul, 3 sqr, 13 add/negate/normalize_weak/normalizes_to_zero (ignoring special cases) */
+    /* Operations: 8 mul, 3 sqr, 11 add/negate/normalizes_to_zero (ignoring special cases) */
    secp256k1_fe z12, u1, u2, s1, s2, h, i, h2, h3, t;
    secp256k1_gej_verify(a);
    secp256k1_ge_verify(b);
    if (a->infinity) {
        VERIFY_CHECK(rzr == NULL);
        secp256k1_gej_set_ge(r, b);
@ -505,11 +557,11 @@ static void secp256k1_gej_add_ge_var(secp256k1_gej *r, const secp256k1_gej *a, c
    }
    secp256k1_fe_sqr(&z12, &a->z);
-    u1 = a->x; secp256k1_fe_normalize_weak(&u1);
+    u1 = a->x;
    secp256k1_fe_mul(&u2, &b->x, &z12);
-    s1 = a->y; secp256k1_fe_normalize_weak(&s1);
+    s1 = a->y;
    secp256k1_fe_mul(&s2, &b->y, &z12); secp256k1_fe_mul(&s2, &s2, &a->z);
-    secp256k1_fe_negate(&h, &u1, 1); secp256k1_fe_add(&h, &u2);
+    secp256k1_fe_negate(&h, &u1, SECP256K1_GEJ_X_MAGNITUDE_MAX); secp256k1_fe_add(&h, &u2);
    secp256k1_fe_negate(&i, &s2, 1); secp256k1_fe_add(&i, &s1);
    if (secp256k1_fe_normalizes_to_zero_var(&h)) {
        if (secp256k1_fe_normalizes_to_zero_var(&i)) {
@ -543,16 +595,18 @@ static void secp256k1_gej_add_ge_var(secp256k1_gej *r, const secp256k1_gej *a, c
    secp256k1_fe_mul(&r->y, &t, &i);
    secp256k1_fe_mul(&h3, &h3, &s1);
    secp256k1_fe_add(&r->y, &h3);
    secp256k1_gej_verify(r);
    if (rzr != NULL) secp256k1_fe_verify(rzr);
 }
 static void secp256k1_gej_add_zinv_var(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_ge *b, const secp256k1_fe *bzinv) {
-    /* 9 mul, 3 sqr, 13 add/negate/normalize_weak/normalizes_to_zero (ignoring special cases) */
+    /* Operations: 9 mul, 3 sqr, 11 add/negate/normalizes_to_zero (ignoring special cases) */
    secp256k1_fe az, z12, u1, u2, s1, s2, h, i, h2, h3, t;
-
+    secp256k1_gej_verify(a);
    secp256k1_ge_verify(b);
    secp256k1_fe_verify(bzinv);
    if (a->infinity) {
        secp256k1_fe bzinv2, bzinv3;
        r->infinity = b->infinity;
@ -561,6 +615,7 @@ static void secp256k1_gej_add_zinv_var(secp256k1_gej *r, const secp256k1_gej *a,
        secp256k1_fe_mul(&r->x, &b->x, &bzinv2);
        secp256k1_fe_mul(&r->y, &b->y, &bzinv3);
        secp256k1_fe_set_int(&r->z, 1);
        secp256k1_gej_verify(r);
        return;
    }
    if (b->infinity) {
@ -579,11 +634,11 @@ static void secp256k1_gej_add_zinv_var(secp256k1_gej *r, const secp256k1_gej *a,
    secp256k1_fe_mul(&az, &a->z, bzinv);
    secp256k1_fe_sqr(&z12, &az);
-    u1 = a->x; secp256k1_fe_normalize_weak(&u1);
+    u1 = a->x;
    secp256k1_fe_mul(&u2, &b->x, &z12);
-    s1 = a->y; secp256k1_fe_normalize_weak(&s1);
+    s1 = a->y;
    secp256k1_fe_mul(&s2, &b->y, &z12); secp256k1_fe_mul(&s2, &s2, &az);
-    secp256k1_fe_negate(&h, &u1, 1); secp256k1_fe_add(&h, &u2);
+    secp256k1_fe_negate(&h, &u1, SECP256K1_GEJ_X_MAGNITUDE_MAX); secp256k1_fe_add(&h, &u2);
    secp256k1_fe_negate(&i, &s2, 1); secp256k1_fe_add(&i, &s1);
    if (secp256k1_fe_normalizes_to_zero_var(&h)) {
        if (secp256k1_fe_normalizes_to_zero_var(&i)) {
@ -611,19 +666,19 @@ static void secp256k1_gej_add_zinv_var(secp256k1_gej *r, const secp256k1_gej *a,
    secp256k1_fe_mul(&r->y, &t, &i);
    secp256k1_fe_mul(&h3, &h3, &s1);
    secp256k1_fe_add(&r->y, &h3);
    secp256k1_gej_verify(r);
 }
 static void secp256k1_gej_add_ge(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_ge *b) {
-    /* Operations: 7 mul, 5 sqr, 24 add/cmov/half/mul_int/negate/normalize_weak/normalizes_to_zero */
+    /* Operations: 7 mul, 5 sqr, 21 add/cmov/half/mul_int/negate/normalizes_to_zero */
    secp256k1_fe zz, u1, u2, s1, s2, t, tt, m, n, q, rr;
    secp256k1_fe m_alt, rr_alt;
    int degenerate;
    secp256k1_gej_verify(a);
    secp256k1_ge_verify(b);
    VERIFY_CHECK(!b->infinity);
    VERIFY_CHECK(a->infinity == 0 || a->infinity == 1);
    /*  In:
     *    Eric Brier and Marc Joye, Weierstrass Elliptic Curves and Side-Channel Attacks.
@ -676,17 +731,17 @@ static void secp256k1_gej_add_ge(secp256k1_gej *r, const secp256k1_gej *a, const
     */
    secp256k1_fe_sqr(&zz, &a->z);                       /* z = Z1^2 */
-    u1 = a->x; secp256k1_fe_normalize_weak(&u1);        /* u1 = U1 = X1*Z2^2 (1) */
+    u1 = a->x;                                          /* u1 = U1 = X1*Z2^2 (GEJ_X_M) */
    secp256k1_fe_mul(&u2, &b->x, &zz);                  /* u2 = U2 = X2*Z1^2 (1) */
-    s1 = a->y; secp256k1_fe_normalize_weak(&s1);        /* s1 = S1 = Y1*Z2^3 (1) */
+    s1 = a->y;                                          /* s1 = S1 = Y1*Z2^3 (GEJ_Y_M) */
    secp256k1_fe_mul(&s2, &b->y, &zz);                  /* s2 = Y2*Z1^2 (1) */
    secp256k1_fe_mul(&s2, &s2, &a->z);                  /* s2 = S2 = Y2*Z1^3 (1) */
-    t = u1; secp256k1_fe_add(&t, &u2);                  /* t = T = U1+U2 (2) */
+    t = u1; secp256k1_fe_add(&t, &u2);                  /* t = T = U1+U2 (GEJ_X_M+1) */
-    m = s1; secp256k1_fe_add(&m, &s2);                  /* m = M = S1+S2 (2) */
+    m = s1; secp256k1_fe_add(&m, &s2);                  /* m = M = S1+S2 (GEJ_Y_M+1) */
    secp256k1_fe_sqr(&rr, &t);                          /* rr = T^2 (1) */
-    secp256k1_fe_negate(&m_alt, &u2, 1);                /* Malt = -X2*Z1^2 */
+    secp256k1_fe_negate(&m_alt, &u2, 1);                /* Malt = -X2*Z1^2 (2) */
-    secp256k1_fe_mul(&tt, &u1, &m_alt);                 /* tt = -U1*U2 (2) */
+    secp256k1_fe_mul(&tt, &u1, &m_alt);                 /* tt = -U1*U2 (1) */
-    secp256k1_fe_add(&rr, &tt);                         /* rr = R = T^2-U1*U2 (3) */
+    secp256k1_fe_add(&rr, &tt);                         /* rr = R = T^2-U1*U2 (2) */
    /* If lambda = R/M = R/0 we have a problem (except in the "trivial"
     * case that Z = z1z2 = 0, and this is special-cased later on). */
    degenerate = secp256k1_fe_normalizes_to_zero(&m);
@ -696,24 +751,25 @@ static void secp256k1_gej_add_ge(secp256k1_gej *r, const secp256k1_gej *a, const
     * non-indeterminate expression for lambda is (y1 - y2)/(x1 - x2),
     * so we set R/M equal to this. */
    rr_alt = s1;
-    secp256k1_fe_mul_int(&rr_alt, 2);       /* rr = Y1*Z2^3 - Y2*Z1^3 (2) */
+    secp256k1_fe_mul_int(&rr_alt, 2);       /* rr_alt = Y1*Z2^3 - Y2*Z1^3 (GEJ_Y_M*2) */
-    secp256k1_fe_add(&m_alt, &u1);          /* Malt = X1*Z2^2 - X2*Z1^2 */
+    secp256k1_fe_add(&m_alt, &u1);          /* Malt = X1*Z2^2 - X2*Z1^2 (GEJ_X_M+2) */
-    secp256k1_fe_cmov(&rr_alt, &rr, !degenerate);
+    secp256k1_fe_cmov(&rr_alt, &rr, !degenerate);       /* rr_alt (GEJ_Y_M*2) */
-    secp256k1_fe_cmov(&m_alt, &m, !degenerate);
+    secp256k1_fe_cmov(&m_alt, &m, !degenerate);         /* m_alt (GEJ_X_M+2) */
    /* Now Ralt / Malt = lambda and is guaranteed not to be Ralt / 0.
     * From here on out Ralt and Malt represent the numerator
     * and denominator of lambda; R and M represent the explicit
     * expressions x1^2 + x2^2 + x1x2 and y1 + y2. */
    secp256k1_fe_sqr(&n, &m_alt);                       /* n = Malt^2 (1) */
-    secp256k1_fe_negate(&q, &t, 2);                     /* q = -T (3) */
+    secp256k1_fe_negate(&q, &t,
        SECP256K1_GEJ_X_MAGNITUDE_MAX + 1);             /* q = -T (GEJ_X_M+2) */
    secp256k1_fe_mul(&q, &q, &n);                       /* q = Q = -T*Malt^2 (1) */
    /* These two lines use the observation that either M == Malt or M == 0,
     * so M^3 * Malt is either Malt^4 (which is computed by squaring), or
     * zero (which is "computed" by cmov). So the cost is one squaring
     * versus two multiplications. */
-    secp256k1_fe_sqr(&n, &n);
+    secp256k1_fe_sqr(&n, &n);                           /* n = Malt^4 (1) */
-    secp256k1_fe_cmov(&n, &m, degenerate);              /* n = M^3 * Malt (2) */
+    secp256k1_fe_cmov(&n, &m, degenerate);              /* n = M^3 * Malt (GEJ_Y_M+1) */
    secp256k1_fe_sqr(&t, &rr_alt);                      /* t = Ralt^2 (1) */
    secp256k1_fe_mul(&r->z, &a->z, &m_alt);             /* r->z = Z3 = Malt*Z (1) */
    secp256k1_fe_add(&t, &q);                           /* t = Ralt^2 + Q (2) */
@ -721,9 +777,10 @@ static void secp256k1_gej_add_ge(secp256k1_gej *r, const secp256k1_gej *a, const
    secp256k1_fe_mul_int(&t, 2);                        /* t = 2*X3 (4) */
    secp256k1_fe_add(&t, &q);                           /* t = 2*X3 + Q (5) */
    secp256k1_fe_mul(&t, &t, &rr_alt);                  /* t = Ralt*(2*X3 + Q) (1) */
-    secp256k1_fe_add(&t, &n);                           /* t = Ralt*(2*X3 + Q) + M^3*Malt (3) */
+    secp256k1_fe_add(&t, &n);                           /* t = Ralt*(2*X3 + Q) + M^3*Malt (GEJ_Y_M+2) */
-    secp256k1_fe_negate(&r->y, &t, 3);                  /* r->y = -(Ralt*(2*X3 + Q) + M^3*Malt) (4) */
+    secp256k1_fe_negate(&r->y, &t,
-    secp256k1_fe_half(&r->y);                           /* r->y = Y3 = -(Ralt*(2*X3 + Q) + M^3*Malt)/2 (3) */
+        SECP256K1_GEJ_Y_MAGNITUDE_MAX + 2);             /* r->y = -(Ralt*(2*X3 + Q) + M^3*Malt) (GEJ_Y_M+3) */
    secp256k1_fe_half(&r->y);                           /* r->y = Y3 = -(Ralt*(2*X3 + Q) + M^3*Malt)/2 ((GEJ_Y_M+3)/2 + 1) */
    /* In case a->infinity == 1, replace r with (b->x, b->y, 1). */
    secp256k1_fe_cmov(&r->x, &b->x, a->infinity);
@ -747,6 +804,7 @@ static void secp256k1_gej_add_ge(secp256k1_gej *r, const secp256k1_gej *a, const
     * We have degenerate = false, r->z = (y1 + y2) * Z.
     * Then r->infinity = ((y1 + y2)Z == 0) = (y1 == -y2) = false. */
    r->infinity = secp256k1_fe_normalizes_to_zero(&r->z);
    secp256k1_gej_verify(r);
 }
@ -758,11 +816,13 @@ static void secp256k1_gej_rescale(secp256k1_gej *r, const secp256k1_fe *s) {
 #ifdef VERIFY
    VERIFY_CHECK(!secp256k1_fe_normalizes_to_zero_var(s));
 #endif
    secp256k1_fe_sqr(&zz, s);
    secp256k1_fe_mul(&r->x, &r->x, &zz);                /* r->x *= s^2 */
    secp256k1_fe_mul(&r->y, &r->y, &zz);
    secp256k1_fe_mul(&r->y, &r->y, s);                  /* r->y *= s^3 */
    secp256k1_fe_mul(&r->z, &r->z, s);                  /* r->z *= s   */
    secp256k1_gej_verify(r);
 }
@ -770,6 +830,7 @@ static void secp256k1_ge_to_storage(secp256k1_ge_storage *r, const secp256k1_ge
    secp256k1_fe x, y;
    secp256k1_ge_verify(a);
    VERIFY_CHECK(!a->infinity);
    x = a->x;
    secp256k1_fe_normalize(&x);
    y = a->y;
@ -782,17 +843,19 @@ static void secp256k1_ge_from_storage(secp256k1_ge *r, const secp256k1_ge_storag
    secp256k1_fe_from_storage(&r->x, &a->x);
    secp256k1_fe_from_storage(&r->y, &a->y);
    r->infinity = 0;
    secp256k1_ge_verify(r);
 }
 static SECP256K1_INLINE void secp256k1_gej_cmov(secp256k1_gej *r, const secp256k1_gej *a, int flag) {
    secp256k1_gej_verify(r);
    secp256k1_gej_verify(a);
    secp256k1_fe_cmov(&r->x, &a->x, flag);
    secp256k1_fe_cmov(&r->y, &a->y, flag);
    secp256k1_fe_cmov(&r->z, &a->z, flag);
    r->infinity ^= (r->infinity ^ a->infinity) & flag;
    secp256k1_gej_verify(r);
 }
@ -802,9 +865,11 @@ static SECP256K1_INLINE void secp256k1_ge_storage_cmov(secp256k1_ge_storage *r,
 }
 static void secp256k1_ge_mul_lambda(secp256k1_ge *r, const secp256k1_ge *a) {
    *r = *a;
    secp256k1_ge_verify(a);
    *r = *a;
    secp256k1_fe_mul(&r->x, &r->x, &secp256k1_const_beta);
    secp256k1_ge_verify(r);
 }
@ -826,8 +891,8 @@ static int secp256k1_ge_is_in_correct_subgroup(const secp256k1_ge* ge) {
 #ifdef EXHAUSTIVE_TEST_ORDER
    secp256k1_gej out;
    int i;
    secp256k1_ge_verify(ge);
    /* A very simple EC multiplication ladder that avoids a dependency on ecmult. */
    secp256k1_gej_set_infinity(&out);
    for (i = 0; i < 32; ++i) {
@ -838,6 +903,8 @@ static int secp256k1_ge_is_in_correct_subgroup(const secp256k1_ge* ge) {
    }
    return secp256k1_gej_is_infinity(&out);
 #else
    secp256k1_ge_verify(ge);
    (void)ge;
    /* The real secp256k1 group has cofactor 1, so the subgroup is the entire curve. */
    return 1;
--- a/src/modules/bppp/tests_impl.h
+++ b/src/modules/bppp/tests_impl.h
@ -22,31 +22,19 @@ static void test_bppp_generators_api(void) {
    unsigned char gens_ser[330];
    size_t len = sizeof(gens_ser);
    int32_t ecount = 0;
    /* The BP generator API requires no precomp */
    secp256k1_context_set_error_callback(CTX, counting_illegal_callback_fn, &ecount);
    secp256k1_context_set_illegal_callback(CTX, counting_illegal_callback_fn, &ecount);
    /* Create */
    gens = secp256k1_bppp_generators_create(CTX, 10);
-    CHECK(gens != NULL && ecount == 0);
+    CHECK(gens != NULL);
    gens_orig = gens; /* Preserve for round-trip test */
    /* Serialize */
-    ecount = 0;
+    CHECK_ILLEGAL(CTX, secp256k1_bppp_generators_serialize(CTX, NULL, gens_ser, &len));
-    CHECK(!secp256k1_bppp_generators_serialize(CTX, NULL, gens_ser, &len));
+    CHECK_ILLEGAL(CTX, secp256k1_bppp_generators_serialize(CTX, gens, NULL, &len));
-    CHECK(ecount == 1);
+    CHECK_ILLEGAL(CTX, secp256k1_bppp_generators_serialize(CTX, gens, gens_ser, NULL));
    CHECK(!secp256k1_bppp_generators_serialize(CTX, gens, NULL, &len));
    CHECK(ecount == 2);
    CHECK(!secp256k1_bppp_generators_serialize(CTX, gens, gens_ser, NULL));
    CHECK(ecount == 3);
    len = 0;
-    CHECK(!secp256k1_bppp_generators_serialize(CTX, gens, gens_ser, &len));
+    CHECK_ILLEGAL(CTX, secp256k1_bppp_generators_serialize(CTX, gens, gens_ser, &len));
    CHECK(ecount == 4);
    len = sizeof(gens_ser) - 1;
-    CHECK(!secp256k1_bppp_generators_serialize(CTX, gens, gens_ser, &len));
+    CHECK_ILLEGAL(CTX, secp256k1_bppp_generators_serialize(CTX, gens, gens_ser, &len));
    CHECK(ecount == 5);
    len = sizeof(gens_ser);
    {
        /* Output buffer can be greater than minimum needed */
@ -54,23 +42,20 @@ static void test_bppp_generators_api(void) {
        size_t len_tmp = sizeof(gens_ser_tmp);
        CHECK(secp256k1_bppp_generators_serialize(CTX, gens, gens_ser_tmp, &len_tmp));
        CHECK(len_tmp == sizeof(gens_ser_tmp) - 1);
        CHECK(ecount == 5);
    }
    /* Parse */
    CHECK(secp256k1_bppp_generators_serialize(CTX, gens, gens_ser, &len));
-    ecount = 0;
+    CHECK_ILLEGAL_VOID(CTX, gens = secp256k1_bppp_generators_parse(CTX, NULL, sizeof(gens_ser));
-    gens = secp256k1_bppp_generators_parse(CTX, NULL, sizeof(gens_ser));
+                            CHECK(gens == NULL));
    CHECK(gens == NULL && ecount == 1);
    /* Not a multiple of 33 */
    gens = secp256k1_bppp_generators_parse(CTX, gens_ser, sizeof(gens_ser) - 1);
-    CHECK(gens == NULL && ecount == 1);
+    CHECK(gens == NULL);
    gens = secp256k1_bppp_generators_parse(CTX, gens_ser, sizeof(gens_ser));
-    CHECK(gens != NULL && ecount == 1);
+    CHECK(gens != NULL);
    /* Not valid generators */
    memset(gens_ser, 1, sizeof(gens_ser));
    CHECK(secp256k1_bppp_generators_parse(CTX, gens_ser, sizeof(gens_ser)) == NULL);
    CHECK(ecount == 1);
    /* Check that round-trip succeeded */
    CHECK(gens->n == gens_orig->n);
@ -79,14 +64,9 @@ static void test_bppp_generators_api(void) {
    }
    /* Destroy (we allow destroying a NULL context, it's just a noop. like free().) */
    ecount = 0;
    secp256k1_bppp_generators_destroy(CTX, NULL);
    secp256k1_bppp_generators_destroy(CTX, gens);
    secp256k1_bppp_generators_destroy(CTX, gens_orig);
    CHECK(ecount == 0);
    secp256k1_context_set_error_callback(CTX, NULL, NULL);
    secp256k1_context_set_illegal_callback(CTX, NULL, NULL);
 }
 static void test_bppp_generators_fixed(void) {
--- a/src/modules/ecdh/tests_impl.h
+++ b/src/modules/ecdh/tests_impl.h
@ -25,32 +25,19 @@ static int ecdh_hash_function_custom(unsigned char *output, const unsigned char
 }
 static void test_ecdh_api(void) {
    /* Setup context that just counts errors */
    secp256k1_context *tctx = secp256k1_context_create(SECP256K1_CONTEXT_NONE);
    secp256k1_pubkey point;
    unsigned char res[32];
    unsigned char s_one[32] = { 0 };
    int32_t ecount = 0;
    s_one[31] = 1;
-    secp256k1_context_set_error_callback(tctx, counting_illegal_callback_fn, &ecount);
+    CHECK(secp256k1_ec_pubkey_create(CTX, &point, s_one) == 1);
    secp256k1_context_set_illegal_callback(tctx, counting_illegal_callback_fn, &ecount);
    CHECK(secp256k1_ec_pubkey_create(tctx, &point, s_one) == 1);
    /* Check all NULLs are detected */
-    CHECK(secp256k1_ecdh(tctx, res, &point, s_one, NULL, NULL) == 1);
+    CHECK(secp256k1_ecdh(CTX, res, &point, s_one, NULL, NULL) == 1);
-    CHECK(ecount == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdh(CTX, NULL, &point, s_one, NULL, NULL));
-    CHECK(secp256k1_ecdh(tctx, NULL, &point, s_one, NULL, NULL) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdh(CTX, res, NULL, s_one, NULL, NULL));
-    CHECK(ecount == 1);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdh(CTX, res, &point, NULL, NULL, NULL));
-    CHECK(secp256k1_ecdh(tctx, res, NULL, s_one, NULL, NULL) == 0);
+    CHECK(secp256k1_ecdh(CTX, res, &point, s_one, NULL, NULL) == 1);
    CHECK(ecount == 2);
    CHECK(secp256k1_ecdh(tctx, res, &point, NULL, NULL, NULL) == 0);
    CHECK(ecount == 3);
    CHECK(secp256k1_ecdh(tctx, res, &point, s_one, NULL, NULL) == 1);
    CHECK(ecount == 3);
    /* Cleanup */
    secp256k1_context_destroy(tctx);
 }
 static void test_ecdh_generator_basepoint(void) {
--- a/src/modules/ecdsa_adaptor/tests_impl.h
+++ b/src/modules/ecdsa_adaptor/tests_impl.h
@ -824,13 +824,6 @@ static void test_ecdsa_adaptor_api(void) {
    unsigned char deckey[32];
    /** setup **/
    int ecount;
    secp256k1_context_set_error_callback(CTX, counting_illegal_callback_fn, &ecount);
    secp256k1_context_set_error_callback(STATIC_CTX, counting_illegal_callback_fn, &ecount);
    secp256k1_context_set_illegal_callback(CTX, counting_illegal_callback_fn, &ecount);
    secp256k1_context_set_illegal_callback(STATIC_CTX, counting_illegal_callback_fn, &ecount);
    secp256k1_testrand256(sk);
    secp256k1_testrand256(msg);
    secp256k1_testrand256(deckey);
@ -839,70 +832,37 @@ static void test_ecdsa_adaptor_api(void) {
    memset(&zero_pk, 0, sizeof(zero_pk));
    /** main test body **/
    ecount = 0;
    CHECK(secp256k1_ecdsa_adaptor_encrypt(CTX, asig, sk, &enckey, msg, NULL, NULL) == 1);
-    CHECK(ecount == 0);
+    CHECK_ILLEGAL(STATIC_CTX, secp256k1_ecdsa_adaptor_encrypt(STATIC_CTX, asig, sk, &enckey, msg, NULL, NULL));
-    CHECK(secp256k1_ecdsa_adaptor_encrypt(STATIC_CTX, asig, sk, &enckey, msg, NULL, NULL) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_adaptor_encrypt(CTX, NULL, sk, &enckey, msg, NULL, NULL));
-    CHECK(ecount == 1);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_adaptor_encrypt(CTX, asig, sk, &enckey, NULL, NULL, NULL));
-    CHECK(secp256k1_ecdsa_adaptor_encrypt(CTX, NULL, sk, &enckey, msg, NULL, NULL) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_adaptor_encrypt(CTX, asig, NULL, &enckey, msg, NULL, NULL));
-    CHECK(ecount == 2);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_adaptor_encrypt(CTX, asig, sk, NULL, msg, NULL, NULL));
-    CHECK(secp256k1_ecdsa_adaptor_encrypt(CTX, asig, sk, &enckey, NULL, NULL, NULL) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_adaptor_encrypt(CTX, asig, sk, &zero_pk, msg, NULL, NULL));
    CHECK(ecount == 3);
    CHECK(secp256k1_ecdsa_adaptor_encrypt(CTX, asig, NULL, &enckey, msg, NULL, NULL) == 0);
    CHECK(ecount == 4);
    CHECK(secp256k1_ecdsa_adaptor_encrypt(CTX, asig, sk, NULL, msg, NULL, NULL) == 0);
    CHECK(ecount == 5);
    CHECK(secp256k1_ecdsa_adaptor_encrypt(CTX, asig, sk, &zero_pk, msg, NULL, NULL) == 0);
    CHECK(ecount == 6);
    ecount = 0;
    CHECK(secp256k1_ecdsa_adaptor_encrypt(CTX, asig, sk, &enckey, msg, NULL, NULL) == 1);
    CHECK(secp256k1_ecdsa_adaptor_verify(CTX, asig, &pubkey, msg, &enckey) == 1);
-    CHECK(ecount == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_adaptor_verify(CTX, NULL, &pubkey, msg, &enckey));
-    CHECK(secp256k1_ecdsa_adaptor_verify(CTX, NULL, &pubkey, msg, &enckey) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_adaptor_verify(CTX, asig, &pubkey, NULL, &enckey));
-    CHECK(ecount == 1);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_adaptor_verify(CTX, asig, &pubkey, msg, NULL));
-    CHECK(secp256k1_ecdsa_adaptor_verify(CTX, asig, &pubkey, NULL, &enckey) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_adaptor_verify(CTX, asig, NULL, msg, &enckey));
-    CHECK(ecount == 2);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_adaptor_verify(CTX, asig, &zero_pk, msg, &enckey));
-    CHECK(secp256k1_ecdsa_adaptor_verify(CTX, asig, &pubkey, msg, NULL) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_adaptor_verify(CTX, asig, &pubkey, msg, &zero_pk));
    CHECK(ecount == 3);
    CHECK(secp256k1_ecdsa_adaptor_verify(CTX, asig, NULL, msg, &enckey) == 0);
    CHECK(ecount == 4);
    CHECK(secp256k1_ecdsa_adaptor_verify(CTX, asig, &zero_pk, msg, &enckey) == 0);
    CHECK(ecount == 5);
    CHECK(secp256k1_ecdsa_adaptor_verify(CTX, asig, &pubkey, msg, &zero_pk) == 0);
    CHECK(ecount == 6);
    ecount = 0;
    CHECK(secp256k1_ecdsa_adaptor_decrypt(CTX, &sig, deckey, asig) == 1);
    CHECK(secp256k1_ecdsa_adaptor_decrypt(CTX, &sig, deckey, asig) == 1);
-    CHECK(secp256k1_ecdsa_adaptor_decrypt(CTX, NULL, deckey, asig) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_adaptor_decrypt(CTX, NULL, deckey, asig));
-    CHECK(ecount == 1);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_adaptor_decrypt(CTX, &sig, NULL, asig));
-    CHECK(secp256k1_ecdsa_adaptor_decrypt(CTX, &sig, NULL, asig) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_adaptor_decrypt(CTX, &sig, deckey, NULL));
    CHECK(ecount == 2);
    CHECK(secp256k1_ecdsa_adaptor_decrypt(CTX, &sig, deckey, NULL) == 0);
    CHECK(ecount == 3);
    ecount = 0;
    CHECK(secp256k1_ecdsa_adaptor_decrypt(CTX, &sig, deckey, asig) == 1);
    CHECK(secp256k1_ecdsa_adaptor_recover(CTX, deckey, &sig, asig, &enckey) == 1);
-    CHECK(ecount == 0);
+    CHECK_ILLEGAL(STATIC_CTX, secp256k1_ecdsa_adaptor_recover(STATIC_CTX, deckey, &sig, asig, &enckey));
-    CHECK(secp256k1_ecdsa_adaptor_recover(STATIC_CTX, deckey, &sig, asig, &enckey) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_adaptor_recover(CTX, NULL, &sig, asig, &enckey));
-    CHECK(ecount == 1);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_adaptor_recover(CTX, deckey, NULL, asig, &enckey));
-    CHECK(secp256k1_ecdsa_adaptor_recover(CTX, NULL, &sig, asig, &enckey) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_adaptor_recover(CTX, deckey, &sig, NULL, &enckey));
-    CHECK(ecount == 2);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_adaptor_recover(CTX, deckey, &sig, asig, NULL));
-    CHECK(secp256k1_ecdsa_adaptor_recover(CTX, deckey, NULL, asig, &enckey) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_adaptor_recover(CTX, deckey, &sig, asig, &zero_pk));
    CHECK(ecount == 3);
    CHECK(secp256k1_ecdsa_adaptor_recover(CTX, deckey, &sig, NULL, &enckey) == 0);
    CHECK(ecount == 4);
    CHECK(secp256k1_ecdsa_adaptor_recover(CTX, deckey, &sig, asig, NULL) == 0);
    CHECK(ecount == 5);
    CHECK(secp256k1_ecdsa_adaptor_recover(CTX, deckey, &sig, asig, &zero_pk) == 0);
    CHECK(ecount == 6);
    secp256k1_context_set_error_callback(CTX, NULL, NULL);
    secp256k1_context_set_error_callback(STATIC_CTX, NULL, NULL);
    secp256k1_context_set_illegal_callback(CTX, NULL, NULL);
    secp256k1_context_set_illegal_callback(STATIC_CTX, NULL, NULL);
 }
 static void adaptor_tests(void) {
--- a/src/modules/ecdsa_s2c/tests_impl.h
+++ b/src/modules/ecdsa_s2c/tests_impl.h
@ -41,34 +41,25 @@ static void run_s2c_opening_test(void) {
            0x02
    };
    secp256k1_ecdsa_s2c_opening opening;
    int32_t ecount = 0;
    secp256k1_context_set_illegal_callback(CTX, counting_illegal_callback_fn, &ecount);
    /* First parsing, then serializing works */
    CHECK(secp256k1_ecdsa_s2c_opening_parse(CTX, &opening, input) == 1);
    CHECK(secp256k1_ecdsa_s2c_opening_serialize(CTX, output, &opening) == 1);
    CHECK(secp256k1_ecdsa_s2c_opening_parse(CTX, &opening, input) == 1);
    CHECK(ecount == 0);
-    CHECK(secp256k1_ecdsa_s2c_opening_parse(CTX, NULL, input) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_s2c_opening_parse(CTX, NULL, input));
-    CHECK(ecount == 1);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_s2c_opening_parse(CTX, &opening, NULL));
    CHECK(secp256k1_ecdsa_s2c_opening_parse(CTX, &opening, NULL) == 0);
    CHECK(ecount == 2);
    CHECK(secp256k1_ecdsa_s2c_opening_parse(CTX, &opening, input) == 1);
-    CHECK(secp256k1_ecdsa_s2c_opening_serialize(CTX, NULL, &opening) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_s2c_opening_serialize(CTX, NULL, &opening));
-    CHECK(ecount == 3);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_s2c_opening_serialize(CTX, output, NULL));
    CHECK(secp256k1_ecdsa_s2c_opening_serialize(CTX, output, NULL) == 0);
-    CHECK(ecount == 4);
+    /* Invalid pubkey makes parsing fail but they are not API errors */
    /* Invalid pubkey makes parsing fail */
    input[0] = 0;  /* bad oddness bit */
    CHECK(secp256k1_ecdsa_s2c_opening_parse(CTX, &opening, input) == 0);
    input[0] = 2;
    input[31] = 1; /* point not on the curve */
    CHECK(secp256k1_ecdsa_s2c_opening_parse(CTX, &opening, input) == 0);
    CHECK(ecount == 4); /* neither of the above are API errors */
    /* Try parsing and serializing a bunch of openings */
    for (i = 0; i < COUNT; i++) {
@ -82,8 +73,6 @@ static void run_s2c_opening_test(void) {
        /* Set pubkey oddness tag to first bit of input[1] */
        input[0] = (input[1] & 1) + 2;
    }
    secp256k1_context_set_illegal_callback(CTX, NULL, NULL);
 }
 static void test_ecdsa_s2c_api(void) {
@ -96,98 +85,55 @@ static void test_ecdsa_s2c_api(void) {
    unsigned char hostrand_commitment[32];
    secp256k1_pubkey pk;
    int32_t ecount;
    secp256k1_context_set_illegal_callback(CTX, counting_illegal_callback_fn, &ecount);
    secp256k1_context_set_illegal_callback(STATIC_CTX, counting_illegal_callback_fn, &ecount);
    CHECK(secp256k1_ec_pubkey_create(CTX, &pk, sec));
-    ecount = 0;
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_s2c_sign(CTX, NULL, &s2c_opening, msg, sec, s2c_data));
-    CHECK(secp256k1_ecdsa_s2c_sign(CTX, NULL, &s2c_opening, msg, sec, s2c_data) == 0);
+    /* NULL opening is not an API error */
    CHECK(ecount == 1);
    CHECK(secp256k1_ecdsa_s2c_sign(CTX, &sig, NULL, msg, sec, s2c_data) == 1);
-    CHECK(ecount == 1); /* NULL opening is not an API error */
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_s2c_sign(CTX, &sig, &s2c_opening, NULL, sec, s2c_data));
-    CHECK(secp256k1_ecdsa_s2c_sign(CTX, &sig, &s2c_opening, NULL, sec, s2c_data) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_s2c_sign(CTX, &sig, &s2c_opening, msg, NULL, s2c_data));
-    CHECK(ecount == 2);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_s2c_sign(CTX, &sig, &s2c_opening, msg, sec, NULL));
    CHECK(secp256k1_ecdsa_s2c_sign(CTX, &sig, &s2c_opening, msg, NULL, s2c_data) == 0);
    CHECK(ecount == 3);
    CHECK(secp256k1_ecdsa_s2c_sign(CTX, &sig, &s2c_opening, msg, sec, NULL) == 0);
    CHECK(ecount == 4);
    CHECK(secp256k1_ecdsa_s2c_sign(CTX, &sig, &s2c_opening, msg, sec, s2c_data) == 1);
-    CHECK(ecount == 4);
+    CHECK_ILLEGAL(STATIC_CTX, secp256k1_ecdsa_s2c_sign(STATIC_CTX, &sig, &s2c_opening, msg, sec, s2c_data));
    CHECK(secp256k1_ecdsa_s2c_sign(STATIC_CTX, &sig, &s2c_opening, msg, sec, s2c_data) == 0);
    CHECK(ecount == 5);
    CHECK(secp256k1_ecdsa_verify(CTX, &sig, msg, &pk) == 1);
-    ecount = 0;
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_s2c_verify_commit(CTX, NULL, s2c_data, &s2c_opening));
-    CHECK(secp256k1_ecdsa_s2c_verify_commit(CTX, NULL, s2c_data, &s2c_opening) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_s2c_verify_commit(CTX, &sig, NULL, &s2c_opening));
-    CHECK(ecount == 1);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_s2c_verify_commit(CTX, &sig, s2c_data, NULL));
    CHECK(secp256k1_ecdsa_s2c_verify_commit(CTX, &sig, NULL, &s2c_opening) == 0);
    CHECK(ecount == 2);
    CHECK(secp256k1_ecdsa_s2c_verify_commit(CTX, &sig, s2c_data, NULL) == 0);
    CHECK(ecount == 3);
    CHECK(secp256k1_ecdsa_s2c_verify_commit(CTX, &sig, s2c_data, &s2c_opening) == 1);
-    CHECK(ecount == 3);
+    /* wrong data is not an API error */
    CHECK(secp256k1_ecdsa_s2c_verify_commit(CTX, &sig, sec, &s2c_opening) == 0);
    CHECK(ecount == 3); /* wrong data is not an API error */
    /* Signing with NULL s2c_opening gives the same result */
    CHECK(secp256k1_ecdsa_s2c_sign(CTX, &sig, NULL, msg, sec, s2c_data) == 1);
    CHECK(secp256k1_ecdsa_s2c_verify_commit(CTX, &sig, s2c_data, &s2c_opening) == 1);
    /* anti-exfil */
-    ecount = 0;
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_anti_exfil_host_commit(CTX, NULL, hostrand));
-    CHECK(secp256k1_ecdsa_anti_exfil_host_commit(CTX, NULL, hostrand) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_anti_exfil_host_commit(CTX, hostrand_commitment, NULL));
    CHECK(ecount == 1);
    CHECK(secp256k1_ecdsa_anti_exfil_host_commit(CTX, hostrand_commitment, NULL) == 0);
    CHECK(ecount == 2);
    CHECK(secp256k1_ecdsa_anti_exfil_host_commit(CTX, hostrand_commitment, hostrand) == 1);
    CHECK(ecount == 2);
-    ecount = 0;
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_anti_exfil_signer_commit(CTX, NULL, msg, sec, hostrand_commitment));
-    CHECK(secp256k1_ecdsa_anti_exfil_signer_commit(CTX, NULL, msg, sec, hostrand_commitment) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_anti_exfil_signer_commit(CTX, &s2c_opening, NULL, sec, hostrand_commitment));
-    CHECK(ecount == 1);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_anti_exfil_signer_commit(CTX, &s2c_opening, msg, NULL, hostrand_commitment));
-    CHECK(secp256k1_ecdsa_anti_exfil_signer_commit(CTX, &s2c_opening, NULL, sec, hostrand_commitment) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_anti_exfil_signer_commit(CTX, &s2c_opening, msg, sec, NULL));
    CHECK(ecount == 2);
    CHECK(secp256k1_ecdsa_anti_exfil_signer_commit(CTX, &s2c_opening, msg, NULL, hostrand_commitment) == 0);
    CHECK(ecount == 3);
    CHECK(secp256k1_ecdsa_anti_exfil_signer_commit(CTX, &s2c_opening, msg, sec, NULL) == 0);
    CHECK(ecount == 4);
    CHECK(secp256k1_ecdsa_anti_exfil_signer_commit(CTX, &s2c_opening, msg, sec, hostrand_commitment) == 1);
-    CHECK(ecount == 4);
+    CHECK_ILLEGAL(STATIC_CTX, secp256k1_ecdsa_anti_exfil_signer_commit(STATIC_CTX, &s2c_opening, msg, sec, hostrand_commitment));
    CHECK(secp256k1_ecdsa_anti_exfil_signer_commit(STATIC_CTX, &s2c_opening, msg, sec, hostrand_commitment) == 0);
    CHECK(ecount == 5);
-    ecount = 0;
+    CHECK_ILLEGAL(CTX, secp256k1_anti_exfil_sign(CTX, NULL, msg, sec, hostrand));
-    CHECK(secp256k1_anti_exfil_sign(CTX, NULL, msg, sec, hostrand) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_anti_exfil_sign(CTX, &sig, NULL, sec, hostrand));
-    CHECK(ecount == 1);
+    CHECK_ILLEGAL(CTX, secp256k1_anti_exfil_sign(CTX, &sig, msg, NULL, hostrand));
-    CHECK(secp256k1_anti_exfil_sign(CTX, &sig, NULL, sec, hostrand) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_anti_exfil_sign(CTX, &sig, msg, sec, NULL));
    CHECK(ecount == 2);
    CHECK(secp256k1_anti_exfil_sign(CTX, &sig, msg, NULL, hostrand) == 0);
    CHECK(ecount == 3);
    CHECK(secp256k1_anti_exfil_sign(CTX, &sig, msg, sec, NULL) == 0);
    CHECK(ecount == 4);
    CHECK(secp256k1_anti_exfil_sign(CTX, &sig, msg, sec, hostrand) == 1);
-    CHECK(ecount == 4);
+    CHECK_ILLEGAL(STATIC_CTX, secp256k1_anti_exfil_sign(STATIC_CTX, &sig, msg, sec, hostrand));
    CHECK(secp256k1_anti_exfil_sign(STATIC_CTX, &sig, msg, sec, hostrand) == 0);
    CHECK(ecount == 5);
-    ecount = 0;
+    CHECK_ILLEGAL(CTX, secp256k1_anti_exfil_host_verify(CTX, NULL, msg, &pk, hostrand, &s2c_opening));
-    CHECK(secp256k1_anti_exfil_host_verify(CTX, NULL, msg, &pk, hostrand, &s2c_opening) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_anti_exfil_host_verify(CTX, &sig, NULL, &pk, hostrand, &s2c_opening));
-    CHECK(ecount == 1);
+    CHECK_ILLEGAL(CTX, secp256k1_anti_exfil_host_verify(CTX, &sig, msg, NULL, hostrand, &s2c_opening));
-    CHECK(secp256k1_anti_exfil_host_verify(CTX, &sig, NULL, &pk, hostrand, &s2c_opening) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_anti_exfil_host_verify(CTX, &sig, msg, &pk, NULL, &s2c_opening));
-    CHECK(ecount == 2);
+    CHECK_ILLEGAL(CTX, secp256k1_anti_exfil_host_verify(CTX, &sig, msg, &pk, hostrand, NULL));
    CHECK(secp256k1_anti_exfil_host_verify(CTX, &sig, msg, NULL, hostrand, &s2c_opening) == 0);
    CHECK(ecount == 3);
    CHECK(secp256k1_anti_exfil_host_verify(CTX, &sig, msg, &pk, NULL, &s2c_opening) == 0);
    CHECK(ecount == 4);
    CHECK(secp256k1_anti_exfil_host_verify(CTX, &sig, msg, &pk, hostrand, NULL) == 0);
    CHECK(ecount == 5);
    CHECK(secp256k1_anti_exfil_host_verify(CTX, &sig, msg, &pk, hostrand, &s2c_opening) == 1);
    CHECK(ecount == 5);
    secp256k1_context_set_illegal_callback(CTX, NULL, NULL);
    secp256k1_context_set_illegal_callback(STATIC_CTX, NULL, NULL);
 }
 /* When using sign-to-contract commitments, the nonce function is fixed, so we can use fixtures to test. */
--- a/src/modules/extrakeys/tests_exhaustive_impl.h
+++ b/src/modules/extrakeys/tests_exhaustive_impl.h
@ -48,7 +48,7 @@ static void test_exhaustive_extrakeys(const secp256k1_context *ctx, const secp25
        /* Compare the xonly_pubkey bytes against the precomputed group. */
        secp256k1_fe_set_b32_mod(&fe, xonly_pubkey_bytes[i - 1]);
-        CHECK(secp256k1_fe_equal_var(&fe, &group[i].x));
+        CHECK(secp256k1_fe_equal(&fe, &group[i].x));
        /* Check the parity against the precomputed group. */
        fe = group[i].y;
--- a/src/modules/extrakeys/tests_impl.h
+++ b/src/modules/extrakeys/tests_impl.h
@ -9,11 +9,6 @@
 #include "../../../include/secp256k1_extrakeys.h"
 static void set_counting_callbacks(secp256k1_context *ctx0, int *ecount) {
    secp256k1_context_set_error_callback(ctx0, counting_illegal_callback_fn, ecount);
    secp256k1_context_set_illegal_callback(ctx0, counting_illegal_callback_fn, ecount);
 }
 static void test_xonly_pubkey(void) {
    secp256k1_pubkey pk;
    secp256k1_xonly_pubkey xonly_pk, xonly_pk_tmp;
@ -28,10 +23,6 @@ static void test_xonly_pubkey(void) {
    int pk_parity;
    int i;
    int ecount;
    set_counting_callbacks(CTX, &ecount);
    secp256k1_testrand256(sk);
    memset(ones32, 0xFF, 32);
    secp256k1_testrand256(xy_sk);
@ -39,16 +30,12 @@ static void test_xonly_pubkey(void) {
    CHECK(secp256k1_xonly_pubkey_from_pubkey(CTX, &xonly_pk, &pk_parity, &pk) == 1);
    /* Test xonly_pubkey_from_pubkey */
    ecount = 0;
    CHECK(secp256k1_xonly_pubkey_from_pubkey(CTX, &xonly_pk, &pk_parity, &pk) == 1);
-    CHECK(secp256k1_xonly_pubkey_from_pubkey(CTX, NULL, &pk_parity, &pk) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_xonly_pubkey_from_pubkey(CTX, NULL, &pk_parity, &pk));
    CHECK(ecount == 1);
    CHECK(secp256k1_xonly_pubkey_from_pubkey(CTX, &xonly_pk, NULL, &pk) == 1);
-    CHECK(secp256k1_xonly_pubkey_from_pubkey(CTX, &xonly_pk, &pk_parity, NULL) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_xonly_pubkey_from_pubkey(CTX, &xonly_pk, &pk_parity, NULL));
    CHECK(ecount == 2);
    memset(&pk, 0, sizeof(pk));
-    CHECK(secp256k1_xonly_pubkey_from_pubkey(CTX, &xonly_pk, &pk_parity, &pk) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_xonly_pubkey_from_pubkey(CTX, &xonly_pk, &pk_parity, &pk));
    CHECK(ecount == 3);
    /* Choose a secret key such that the resulting pubkey and xonly_pubkey match. */
    memset(sk, 0, sizeof(sk));
@ -72,28 +59,21 @@ static void test_xonly_pubkey(void) {
    CHECK(secp256k1_fe_equal(&pk1.y, &y) == 1);
    /* Test xonly_pubkey_serialize and xonly_pubkey_parse */
-    ecount = 0;
+    CHECK_ILLEGAL(CTX, secp256k1_xonly_pubkey_serialize(CTX, NULL, &xonly_pk));
-    CHECK(secp256k1_xonly_pubkey_serialize(CTX, NULL, &xonly_pk) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_xonly_pubkey_serialize(CTX, buf32, NULL));
    CHECK(ecount == 1);
    CHECK(secp256k1_xonly_pubkey_serialize(CTX, buf32, NULL) == 0);
    CHECK(secp256k1_memcmp_var(buf32, zeros64, 32) == 0);
    CHECK(ecount == 2);
    {
        /* A pubkey filled with 0s will fail to serialize due to pubkey_load
         * special casing. */
        secp256k1_xonly_pubkey pk_tmp;
        memset(&pk_tmp, 0, sizeof(pk_tmp));
-        CHECK(secp256k1_xonly_pubkey_serialize(CTX, buf32, &pk_tmp) == 0);
+        /* pubkey_load calls illegal callback */
        CHECK_ILLEGAL(CTX, secp256k1_xonly_pubkey_serialize(CTX, buf32, &pk_tmp));
    }
    /* pubkey_load called illegal callback */
    CHECK(ecount == 3);
    CHECK(secp256k1_xonly_pubkey_serialize(CTX, buf32, &xonly_pk) == 1);
-    ecount = 0;
+    CHECK_ILLEGAL(CTX, secp256k1_xonly_pubkey_parse(CTX, NULL, buf32));
-    CHECK(secp256k1_xonly_pubkey_parse(CTX, NULL, buf32) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_xonly_pubkey_parse(CTX, &xonly_pk, NULL));
    CHECK(ecount == 1);
    CHECK(secp256k1_xonly_pubkey_parse(CTX, &xonly_pk, NULL) == 0);
    CHECK(ecount == 2);
    /* Serialization and parse roundtrip */
    CHECK(secp256k1_xonly_pubkey_from_pubkey(CTX, &xonly_pk, NULL, &pk) == 1);
@ -125,7 +105,6 @@ static void test_xonly_pubkey(void) {
            CHECK(secp256k1_xonly_pubkey_parse(CTX, &xonly_pk, &rand33[1]) == 1);
        }
    }
    CHECK(ecount == 2);
 }
 static void test_xonly_pubkey_comparison(void) {
@ -139,29 +118,26 @@ static void test_xonly_pubkey_comparison(void) {
    };
    secp256k1_xonly_pubkey pk1;
    secp256k1_xonly_pubkey pk2;
    int ecount = 0;
    set_counting_callbacks(CTX, &ecount);
    CHECK(secp256k1_xonly_pubkey_parse(CTX, &pk1, pk1_ser) == 1);
    CHECK(secp256k1_xonly_pubkey_parse(CTX, &pk2, pk2_ser) == 1);
-    CHECK(secp256k1_xonly_pubkey_cmp(CTX, NULL, &pk2) < 0);
+    CHECK_ILLEGAL_VOID(CTX, CHECK(secp256k1_xonly_pubkey_cmp(CTX, NULL, &pk2) < 0));
-    CHECK(ecount == 1);
+    CHECK_ILLEGAL_VOID(CTX, CHECK(secp256k1_xonly_pubkey_cmp(CTX, &pk1, NULL) > 0));
    CHECK(secp256k1_xonly_pubkey_cmp(CTX, &pk1, NULL) > 0);
    CHECK(ecount == 2);
    CHECK(secp256k1_xonly_pubkey_cmp(CTX, &pk1, &pk2) < 0);
    CHECK(secp256k1_xonly_pubkey_cmp(CTX, &pk2, &pk1) > 0);
    CHECK(secp256k1_xonly_pubkey_cmp(CTX, &pk1, &pk1) == 0);
    CHECK(secp256k1_xonly_pubkey_cmp(CTX, &pk2, &pk2) == 0);
    CHECK(ecount == 2);
    memset(&pk1, 0, sizeof(pk1)); /* illegal pubkey */
-    CHECK(secp256k1_xonly_pubkey_cmp(CTX, &pk1, &pk2) < 0);
+    CHECK_ILLEGAL_VOID(CTX, CHECK(secp256k1_xonly_pubkey_cmp(CTX, &pk1, &pk2) < 0));
-    CHECK(ecount == 3);
+    {
        int32_t ecount = 0;
        secp256k1_context_set_illegal_callback(CTX, counting_callback_fn, &ecount);
        CHECK(secp256k1_xonly_pubkey_cmp(CTX, &pk1, &pk1) == 0);
-    CHECK(ecount == 5);
+        CHECK(ecount == 2);
-    CHECK(secp256k1_xonly_pubkey_cmp(CTX, &pk2, &pk1) > 0);
+        secp256k1_context_set_illegal_callback(CTX, NULL, NULL);
-    CHECK(ecount == 6);
+    }
    CHECK_ILLEGAL_VOID(CTX, CHECK(secp256k1_xonly_pubkey_cmp(CTX, &pk2, &pk1) > 0));
 }
 static void test_xonly_pubkey_tweak(void) {
@ -175,30 +151,20 @@ static void test_xonly_pubkey_tweak(void) {
    unsigned char tweak[32];
    int i;
    int ecount;
    set_counting_callbacks(CTX, &ecount);
    memset(overflows, 0xff, sizeof(overflows));
    secp256k1_testrand256(tweak);
    secp256k1_testrand256(sk);
    CHECK(secp256k1_ec_pubkey_create(CTX, &internal_pk, sk) == 1);
    CHECK(secp256k1_xonly_pubkey_from_pubkey(CTX, &internal_xonly_pk, &pk_parity, &internal_pk) == 1);
    ecount = 0;
    CHECK(secp256k1_xonly_pubkey_tweak_add(CTX, &output_pk, &internal_xonly_pk, tweak) == 1);
    CHECK(ecount == 0);
    CHECK(secp256k1_xonly_pubkey_tweak_add(CTX, &output_pk, &internal_xonly_pk, tweak) == 1);
    CHECK(ecount == 0);
    CHECK(secp256k1_xonly_pubkey_tweak_add(CTX, &output_pk, &internal_xonly_pk, tweak) == 1);
-    CHECK(secp256k1_xonly_pubkey_tweak_add(CTX, NULL, &internal_xonly_pk, tweak) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_xonly_pubkey_tweak_add(CTX, NULL, &internal_xonly_pk, tweak));
-    CHECK(ecount == 1);
+    CHECK_ILLEGAL(CTX, secp256k1_xonly_pubkey_tweak_add(CTX, &output_pk, NULL, tweak));
    CHECK(secp256k1_xonly_pubkey_tweak_add(CTX, &output_pk, NULL, tweak) == 0);
    CHECK(ecount == 2);
    /* NULL internal_xonly_pk zeroes the output_pk */
    CHECK(secp256k1_memcmp_var(&output_pk, zeros64, sizeof(output_pk)) == 0);
-    CHECK(secp256k1_xonly_pubkey_tweak_add(CTX, &output_pk, &internal_xonly_pk, NULL) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_xonly_pubkey_tweak_add(CTX, &output_pk, &internal_xonly_pk, NULL));
    CHECK(ecount == 3);
    /* NULL tweak zeroes the output_pk */
    CHECK(secp256k1_memcmp_var(&output_pk, zeros64, sizeof(output_pk)) == 0);
@ -225,9 +191,7 @@ static void test_xonly_pubkey_tweak(void) {
    /* Invalid pk with a valid tweak */
    memset(&internal_xonly_pk, 0, sizeof(internal_xonly_pk));
    secp256k1_testrand256(tweak);
-    ecount = 0;
+    CHECK_ILLEGAL(CTX, secp256k1_xonly_pubkey_tweak_add(CTX, &output_pk, &internal_xonly_pk, tweak));
    CHECK(secp256k1_xonly_pubkey_tweak_add(CTX, &output_pk, &internal_xonly_pk, tweak) == 0);
    CHECK(ecount == 1);
    CHECK(secp256k1_memcmp_var(&output_pk, zeros64, sizeof(output_pk))  == 0);
 }
@ -244,34 +208,23 @@ static void test_xonly_pubkey_tweak_check(void) {
    int pk_parity;
    unsigned char tweak[32];
    int ecount;
    set_counting_callbacks(CTX, &ecount);
    memset(overflows, 0xff, sizeof(overflows));
    secp256k1_testrand256(tweak);
    secp256k1_testrand256(sk);
    CHECK(secp256k1_ec_pubkey_create(CTX, &internal_pk, sk) == 1);
    CHECK(secp256k1_xonly_pubkey_from_pubkey(CTX, &internal_xonly_pk, &pk_parity, &internal_pk) == 1);
    ecount = 0;
    CHECK(secp256k1_xonly_pubkey_tweak_add(CTX, &output_pk, &internal_xonly_pk, tweak) == 1);
    CHECK(secp256k1_xonly_pubkey_from_pubkey(CTX, &output_xonly_pk, &pk_parity, &output_pk) == 1);
    CHECK(secp256k1_xonly_pubkey_serialize(CTX, buf32, &output_xonly_pk) == 1);
    CHECK(secp256k1_xonly_pubkey_tweak_add_check(CTX, buf32, pk_parity, &internal_xonly_pk, tweak) == 1);
    CHECK(ecount == 0);
    CHECK(secp256k1_xonly_pubkey_tweak_add_check(CTX, buf32, pk_parity, &internal_xonly_pk, tweak) == 1);
    CHECK(ecount == 0);
    CHECK(secp256k1_xonly_pubkey_tweak_add_check(CTX, buf32, pk_parity, &internal_xonly_pk, tweak) == 1);
-    CHECK(secp256k1_xonly_pubkey_tweak_add_check(CTX, NULL, pk_parity, &internal_xonly_pk, tweak) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_xonly_pubkey_tweak_add_check(CTX, NULL, pk_parity, &internal_xonly_pk, tweak));
    CHECK(ecount == 1);
    /* invalid pk_parity value */
    CHECK(secp256k1_xonly_pubkey_tweak_add_check(CTX, buf32, 2, &internal_xonly_pk, tweak) == 0);
-    CHECK(ecount == 1);
+    CHECK_ILLEGAL(CTX, secp256k1_xonly_pubkey_tweak_add_check(CTX, buf32, pk_parity, NULL, tweak));
-    CHECK(secp256k1_xonly_pubkey_tweak_add_check(CTX, buf32, pk_parity, NULL, tweak) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_xonly_pubkey_tweak_add_check(CTX, buf32, pk_parity, &internal_xonly_pk, NULL));
    CHECK(ecount == 2);
    CHECK(secp256k1_xonly_pubkey_tweak_add_check(CTX, buf32, pk_parity, &internal_xonly_pk, NULL) == 0);
    CHECK(ecount == 3);
    memset(tweak, 1, sizeof(tweak));
    CHECK(secp256k1_xonly_pubkey_from_pubkey(CTX, &internal_xonly_pk, NULL, &internal_pk) == 1);
@ -290,7 +243,6 @@ static void test_xonly_pubkey_tweak_check(void) {
    CHECK(secp256k1_xonly_pubkey_tweak_add_check(CTX, output_pk32, pk_parity, &internal_xonly_pk, overflows) == 0);
    CHECK(secp256k1_xonly_pubkey_tweak_add(CTX, &output_pk, &internal_xonly_pk, overflows) == 0);
    CHECK(secp256k1_memcmp_var(&output_pk, zeros64, sizeof(output_pk)) == 0);
    CHECK(ecount == 3);
 }
 /* Starts with an initial pubkey and recursively creates N_PUBKEYS - 1
@ -335,33 +287,22 @@ static void test_keypair(void) {
    secp256k1_pubkey pk, pk_tmp;
    secp256k1_xonly_pubkey xonly_pk, xonly_pk_tmp;
    int pk_parity, pk_parity_tmp;
    int ecount;
    set_counting_callbacks(CTX, &ecount);
    set_counting_callbacks(STATIC_CTX, &ecount);
    CHECK(sizeof(zeros96) == sizeof(keypair));
    memset(overflows, 0xFF, sizeof(overflows));
    /* Test keypair_create */
    ecount = 0;
    secp256k1_testrand256(sk);
    CHECK(secp256k1_keypair_create(CTX, &keypair, sk) == 1);
    CHECK(secp256k1_memcmp_var(zeros96, &keypair, sizeof(keypair)) != 0);
    CHECK(ecount == 0);
    CHECK(secp256k1_keypair_create(CTX, &keypair, sk) == 1);
    CHECK(secp256k1_memcmp_var(zeros96, &keypair, sizeof(keypair)) != 0);
-    CHECK(ecount == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_keypair_create(CTX, NULL, sk));
-    CHECK(secp256k1_keypair_create(CTX, NULL, sk) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_keypair_create(CTX, &keypair, NULL));
    CHECK(ecount == 1);
    CHECK(secp256k1_keypair_create(CTX, &keypair, NULL) == 0);
    CHECK(secp256k1_memcmp_var(zeros96, &keypair, sizeof(keypair)) == 0);
    CHECK(ecount == 2);
    CHECK(secp256k1_keypair_create(CTX, &keypair, sk) == 1);
-    CHECK(ecount == 2);
+    CHECK_ILLEGAL(STATIC_CTX, secp256k1_keypair_create(STATIC_CTX, &keypair, sk));
    CHECK(secp256k1_keypair_create(STATIC_CTX, &keypair, sk) == 0);
    CHECK(secp256k1_memcmp_var(zeros96, &keypair, sizeof(keypair)) == 0);
    CHECK(ecount == 3);
    /* Invalid secret key */
    CHECK(secp256k1_keypair_create(CTX, &keypair, zeros96) == 0);
@ -370,14 +311,11 @@ static void test_keypair(void) {
    CHECK(secp256k1_memcmp_var(zeros96, &keypair, sizeof(keypair)) == 0);
    /* Test keypair_pub */
    ecount = 0;
    secp256k1_testrand256(sk);
    CHECK(secp256k1_keypair_create(CTX, &keypair, sk) == 1);
    CHECK(secp256k1_keypair_pub(CTX, &pk, &keypair) == 1);
-    CHECK(secp256k1_keypair_pub(CTX, NULL, &keypair) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_keypair_pub(CTX, NULL, &keypair));
-    CHECK(ecount == 1);
+    CHECK_ILLEGAL(CTX, secp256k1_keypair_pub(CTX, &pk, NULL));
    CHECK(secp256k1_keypair_pub(CTX, &pk, NULL) == 0);
    CHECK(ecount == 2);
    CHECK(secp256k1_memcmp_var(zeros96, &pk, sizeof(pk)) == 0);
    /* Using an invalid keypair is fine for keypair_pub */
@ -392,23 +330,19 @@ static void test_keypair(void) {
    CHECK(secp256k1_memcmp_var(&pk, &pk_tmp, sizeof(pk)) == 0);
    /** Test keypair_xonly_pub **/
    ecount = 0;
    secp256k1_testrand256(sk);
    CHECK(secp256k1_keypair_create(CTX, &keypair, sk) == 1);
    CHECK(secp256k1_keypair_xonly_pub(CTX, &xonly_pk, &pk_parity, &keypair) == 1);
-    CHECK(secp256k1_keypair_xonly_pub(CTX, NULL, &pk_parity, &keypair) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_keypair_xonly_pub(CTX, NULL, &pk_parity, &keypair));
    CHECK(ecount == 1);
    CHECK(secp256k1_keypair_xonly_pub(CTX, &xonly_pk, NULL, &keypair) == 1);
-    CHECK(secp256k1_keypair_xonly_pub(CTX, &xonly_pk, &pk_parity, NULL) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_keypair_xonly_pub(CTX, &xonly_pk, &pk_parity, NULL));
    CHECK(ecount == 2);
    CHECK(secp256k1_memcmp_var(zeros96, &xonly_pk, sizeof(xonly_pk)) == 0);
    /* Using an invalid keypair will set the xonly_pk to 0 (first reset
     * xonly_pk). */
    CHECK(secp256k1_keypair_xonly_pub(CTX, &xonly_pk, &pk_parity, &keypair) == 1);
    memset(&keypair, 0, sizeof(keypair));
-    CHECK(secp256k1_keypair_xonly_pub(CTX, &xonly_pk, &pk_parity, &keypair) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_keypair_xonly_pub(CTX, &xonly_pk, &pk_parity, &keypair));
    CHECK(secp256k1_memcmp_var(zeros96, &xonly_pk, sizeof(xonly_pk)) == 0);
    CHECK(ecount == 3);
    /** keypair holds the same xonly pubkey as pubkey_create **/
    CHECK(secp256k1_ec_pubkey_create(CTX, &pk, sk) == 1);
@ -419,14 +353,11 @@ static void test_keypair(void) {
    CHECK(pk_parity == pk_parity_tmp);
    /* Test keypair_seckey */
    ecount = 0;
    secp256k1_testrand256(sk);
    CHECK(secp256k1_keypair_create(CTX, &keypair, sk) == 1);
    CHECK(secp256k1_keypair_sec(CTX, sk_tmp, &keypair) == 1);
-    CHECK(secp256k1_keypair_sec(CTX, NULL, &keypair) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_keypair_sec(CTX, NULL, &keypair));
-    CHECK(ecount == 1);
+    CHECK_ILLEGAL(CTX, secp256k1_keypair_sec(CTX, sk_tmp, NULL));
    CHECK(secp256k1_keypair_sec(CTX, sk_tmp, NULL) == 0);
    CHECK(ecount == 2);
    CHECK(secp256k1_memcmp_var(zeros96, sk_tmp, sizeof(sk_tmp)) == 0);
    /* keypair returns the same seckey it got */
@ -439,9 +370,6 @@ static void test_keypair(void) {
    memset(&keypair, 0, sizeof(keypair));
    CHECK(secp256k1_keypair_sec(CTX, sk_tmp, &keypair) == 1);
    CHECK(secp256k1_memcmp_var(zeros96, sk_tmp, sizeof(sk_tmp)) == 0);
    secp256k1_context_set_error_callback(STATIC_CTX, NULL, NULL);
    secp256k1_context_set_illegal_callback(STATIC_CTX, NULL, NULL);
 }
 static void test_keypair_add(void) {
@ -451,9 +379,6 @@ static void test_keypair_add(void) {
    unsigned char zeros96[96] = { 0 };
    unsigned char tweak[32];
    int i;
    int ecount = 0;
    set_counting_callbacks(CTX, &ecount);
    CHECK(sizeof(zeros96) == sizeof(keypair));
    secp256k1_testrand256(sk);
@ -462,14 +387,10 @@ static void test_keypair_add(void) {
    CHECK(secp256k1_keypair_create(CTX, &keypair, sk) == 1);
    CHECK(secp256k1_keypair_xonly_tweak_add(CTX, &keypair, tweak) == 1);
    CHECK(ecount == 0);
    CHECK(secp256k1_keypair_xonly_tweak_add(CTX, &keypair, tweak) == 1);
    CHECK(ecount == 0);
    CHECK(secp256k1_keypair_xonly_tweak_add(CTX, &keypair, tweak) == 1);
-    CHECK(secp256k1_keypair_xonly_tweak_add(CTX, NULL, tweak) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_keypair_xonly_tweak_add(CTX, NULL, tweak));
-    CHECK(ecount == 1);
+    CHECK_ILLEGAL(CTX, secp256k1_keypair_xonly_tweak_add(CTX, &keypair, NULL));
    CHECK(secp256k1_keypair_xonly_tweak_add(CTX, &keypair, NULL) == 0);
    CHECK(ecount == 2);
    /* This does not set the keypair to zeroes */
    CHECK(secp256k1_memcmp_var(&keypair, zeros96, sizeof(keypair)) != 0);
@ -503,20 +424,16 @@ static void test_keypair_add(void) {
    /* Invalid keypair with a valid tweak */
    memset(&keypair, 0, sizeof(keypair));
    secp256k1_testrand256(tweak);
-    ecount = 0;
+    CHECK_ILLEGAL(CTX, secp256k1_keypair_xonly_tweak_add(CTX, &keypair, tweak));
    CHECK(secp256k1_keypair_xonly_tweak_add(CTX, &keypair, tweak) == 0);
    CHECK(ecount == 1);
    CHECK(secp256k1_memcmp_var(&keypair, zeros96, sizeof(keypair))  == 0);
    /* Only seckey part of keypair invalid */
    CHECK(secp256k1_keypair_create(CTX, &keypair, sk) == 1);
    memset(&keypair, 0, 32);
-    CHECK(secp256k1_keypair_xonly_tweak_add(CTX, &keypair, tweak) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_keypair_xonly_tweak_add(CTX, &keypair, tweak));
    CHECK(ecount == 2);
    /* Only pubkey part of keypair invalid */
    CHECK(secp256k1_keypair_create(CTX, &keypair, sk) == 1);
    memset(&keypair.data[32], 0, 64);
-    CHECK(secp256k1_keypair_xonly_tweak_add(CTX, &keypair, tweak) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_keypair_xonly_tweak_add(CTX, &keypair, tweak));
    CHECK(ecount == 3);
    /* Check that the keypair_tweak_add implementation is correct */
    CHECK(secp256k1_keypair_create(CTX, &keypair, sk) == 1);
@ -603,29 +520,26 @@ static void test_pubkey_comparison(void) {
    };
    secp256k1_pubkey pk1;
    secp256k1_pubkey pk2;
    int ecount = 0;
    set_counting_callbacks(CTX, &ecount);
    CHECK(secp256k1_ec_pubkey_parse(CTX, &pk1, pk1_ser, sizeof(pk1_ser)) == 1);
    CHECK(secp256k1_ec_pubkey_parse(CTX, &pk2, pk2_ser, sizeof(pk2_ser)) == 1);
-    CHECK(secp256k1_pubkey_cmp(CTX, NULL, &pk2) < 0);
+    CHECK_ILLEGAL_VOID(CTX, CHECK(secp256k1_pubkey_cmp(CTX, NULL, &pk2) < 0));
-    CHECK(ecount == 1);
+    CHECK_ILLEGAL_VOID(CTX, CHECK(secp256k1_pubkey_cmp(CTX, &pk1, NULL) > 0));
    CHECK(secp256k1_pubkey_cmp(CTX, &pk1, NULL) > 0);
    CHECK(ecount == 2);
    CHECK(secp256k1_pubkey_cmp(CTX, &pk1, &pk2) < 0);
    CHECK(secp256k1_pubkey_cmp(CTX, &pk2, &pk1) > 0);
    CHECK(secp256k1_pubkey_cmp(CTX, &pk1, &pk1) == 0);
    CHECK(secp256k1_pubkey_cmp(CTX, &pk2, &pk2) == 0);
    CHECK(ecount == 2);
    memset(&pk1, 0, sizeof(pk1)); /* illegal pubkey */
-    CHECK(secp256k1_pubkey_cmp(CTX, &pk1, &pk2) < 0);
+    CHECK_ILLEGAL_VOID(CTX, CHECK(secp256k1_pubkey_cmp(CTX, &pk1, &pk2) < 0));
-    CHECK(ecount == 3);
+    {
        int32_t ecount = 0;
        secp256k1_context_set_illegal_callback(CTX, counting_callback_fn, &ecount);
        CHECK(secp256k1_pubkey_cmp(CTX, &pk1, &pk1) == 0);
-    CHECK(ecount == 5);
+        CHECK(ecount == 2);
-    CHECK(secp256k1_pubkey_cmp(CTX, &pk2, &pk1) > 0);
+        secp256k1_context_set_illegal_callback(CTX, NULL, NULL);
-    CHECK(ecount == 6);
+    }
    CHECK_ILLEGAL_VOID(CTX, CHECK(secp256k1_pubkey_cmp(CTX, &pk2, &pk1) > 0));
 }
@ -662,12 +576,9 @@ static void rand_pk(secp256k1_pubkey *pk) {
 }
 static void test_sort_api(void) {
    int ecount = 0;
    secp256k1_pubkey pks[2];
    const secp256k1_pubkey *pks_ptr[2];
    set_counting_callbacks(CTX, &ecount);
    pks_ptr[0] = &pks[0];
    pks_ptr[1] = &pks[1];
@ -675,17 +586,19 @@ static void test_sort_api(void) {
    rand_pk(&pks[1]);
    CHECK(secp256k1_pubkey_sort(CTX, pks_ptr, 2) == 1);
-    CHECK(secp256k1_pubkey_sort(CTX, NULL, 2) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_pubkey_sort(CTX, NULL, 2));
    CHECK(ecount == 1);
    CHECK(secp256k1_pubkey_sort(CTX, pks_ptr, 0) == 1);
    /* Test illegal public keys */
    memset(&pks[0], 0, sizeof(pks[0]));
    CHECK_ILLEGAL_VOID(CTX, CHECK(secp256k1_pubkey_sort(CTX, pks_ptr, 2) == 1));
    memset(&pks[1], 0, sizeof(pks[1]));
    {
        int32_t ecount = 0;
        secp256k1_context_set_illegal_callback(CTX, counting_callback_fn, &ecount);
        CHECK(secp256k1_pubkey_sort(CTX, pks_ptr, 2) == 1);
        CHECK(ecount == 2);
-    memset(&pks[1], 0, sizeof(pks[1]));
+        secp256k1_context_set_illegal_callback(CTX, NULL, NULL);
-    CHECK(secp256k1_pubkey_sort(CTX, pks_ptr, 2) == 1);
+    }
    CHECK(ecount > 2);
 }
 static void test_sort(void) {
--- a/src/modules/generator/tests_impl.h
+++ b/src/modules/generator/tests_impl.h
@ -22,52 +22,28 @@ static void test_generator_api(void) {
    unsigned char blind[32];
    unsigned char sergen[33];
    secp256k1_generator gen;
    int32_t ecount = 0;
    secp256k1_context_set_error_callback(CTX, counting_illegal_callback_fn, &ecount);
    secp256k1_context_set_error_callback(STATIC_CTX, counting_illegal_callback_fn, &ecount);
    secp256k1_context_set_illegal_callback(CTX, counting_illegal_callback_fn, &ecount);
    secp256k1_context_set_illegal_callback(STATIC_CTX, counting_illegal_callback_fn, &ecount);
    secp256k1_testrand256(key);
    secp256k1_testrand256(blind);
    CHECK(secp256k1_generator_generate(CTX, &gen, key) == 1);
-    CHECK(ecount == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_generator_generate(CTX, NULL, key));
-    CHECK(secp256k1_generator_generate(CTX, NULL, key) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_generator_generate(CTX, &gen, NULL));
    CHECK(ecount == 1);
    CHECK(secp256k1_generator_generate(CTX, &gen, NULL) == 0);
    CHECK(ecount == 2);
    CHECK(secp256k1_generator_generate_blinded(CTX, &gen, key, blind) == 1);
-    CHECK(ecount == 2);
+    CHECK_ILLEGAL(STATIC_CTX, secp256k1_generator_generate_blinded(STATIC_CTX, &gen, key, blind));
-    CHECK(secp256k1_generator_generate_blinded(STATIC_CTX, &gen, key, blind) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_generator_generate_blinded(CTX, NULL, key, blind));
-    CHECK(ecount == 3);
+    CHECK_ILLEGAL(CTX, secp256k1_generator_generate_blinded(CTX, &gen, NULL, blind));
-    CHECK(secp256k1_generator_generate_blinded(CTX, NULL, key, blind) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_generator_generate_blinded(CTX, &gen, key, NULL));
    CHECK(ecount == 4);
    CHECK(secp256k1_generator_generate_blinded(CTX, &gen, NULL, blind) == 0);
    CHECK(ecount == 5);
    CHECK(secp256k1_generator_generate_blinded(CTX, &gen, key, NULL) == 0);
    CHECK(ecount == 6);
    CHECK(secp256k1_generator_serialize(CTX, sergen, &gen) == 1);
-    CHECK(ecount == 6);
+    CHECK_ILLEGAL(CTX, secp256k1_generator_serialize(CTX, NULL, &gen));
-    CHECK(secp256k1_generator_serialize(CTX, NULL, &gen) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_generator_serialize(CTX, sergen, NULL));
    CHECK(ecount == 7);
    CHECK(secp256k1_generator_serialize(CTX, sergen, NULL) == 0);
    CHECK(ecount == 8);
    CHECK(secp256k1_generator_serialize(CTX, sergen, &gen) == 1);
    CHECK(secp256k1_generator_parse(CTX, &gen, sergen) == 1);
-    CHECK(ecount == 8);
+    CHECK_ILLEGAL(CTX, secp256k1_generator_parse(CTX, NULL, sergen));
-    CHECK(secp256k1_generator_parse(CTX, NULL, sergen) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_generator_parse(CTX, &gen, NULL));
    CHECK(ecount == 9);
    CHECK(secp256k1_generator_parse(CTX, &gen, NULL) == 0);
    CHECK(ecount == 10);
    secp256k1_context_set_error_callback(CTX, NULL, NULL);
    secp256k1_context_set_error_callback(STATIC_CTX, NULL, NULL);
    secp256k1_context_set_illegal_callback(CTX, NULL, NULL);
    secp256k1_context_set_illegal_callback(STATIC_CTX, NULL, NULL);
 }
 static void test_shallue_van_de_woestijne(void) {
@ -219,65 +195,35 @@ static void test_pedersen_api(void) {
    const unsigned char *blind_ptr = blind;
    unsigned char *blind_out_ptr = blind_out;
    uint64_t val = secp256k1_testrand32();
    int32_t ecount = 0;
    secp256k1_context_set_error_callback(CTX, counting_illegal_callback_fn, &ecount);
    secp256k1_context_set_error_callback(STATIC_CTX, counting_illegal_callback_fn, &ecount);
    secp256k1_context_set_illegal_callback(CTX, counting_illegal_callback_fn, &ecount);
    secp256k1_context_set_illegal_callback(STATIC_CTX, counting_illegal_callback_fn, &ecount);
    secp256k1_testrand256(blind);
    CHECK(secp256k1_pedersen_commit(CTX, &commit, blind, val, secp256k1_generator_h) != 0);
-    CHECK(ecount == 0);
+    CHECK_ILLEGAL(STATIC_CTX, secp256k1_pedersen_commit(STATIC_CTX, &commit, blind, val, secp256k1_generator_h));
    CHECK(secp256k1_pedersen_commit(STATIC_CTX, &commit, blind, val, secp256k1_generator_h) == 0);
    CHECK(ecount == 1);
-    CHECK(secp256k1_pedersen_commit(CTX, NULL, blind, val, secp256k1_generator_h) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_pedersen_commit(CTX, NULL, blind, val, secp256k1_generator_h));
-    CHECK(ecount == 2);
+    CHECK_ILLEGAL(CTX, secp256k1_pedersen_commit(CTX, &commit, NULL, val, secp256k1_generator_h));
-    CHECK(secp256k1_pedersen_commit(CTX, &commit, NULL, val, secp256k1_generator_h) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_pedersen_commit(CTX, &commit, blind, val, NULL));
    CHECK(ecount == 3);
    CHECK(secp256k1_pedersen_commit(CTX, &commit, blind, val, NULL) == 0);
    CHECK(ecount == 4);
    CHECK(secp256k1_pedersen_blind_sum(CTX, blind_out, &blind_ptr, 1, 1) != 0);
-    CHECK(ecount == 4);
+    CHECK_ILLEGAL(CTX, secp256k1_pedersen_blind_sum(CTX, NULL, &blind_ptr, 1, 1));
-    CHECK(secp256k1_pedersen_blind_sum(CTX, NULL, &blind_ptr, 1, 1) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_pedersen_blind_sum(CTX, blind_out, NULL, 1, 1));
-    CHECK(ecount == 5);
+    CHECK_ILLEGAL(CTX, secp256k1_pedersen_blind_sum(CTX, blind_out, &blind_ptr, 0, 1));
    CHECK(secp256k1_pedersen_blind_sum(CTX, blind_out, NULL, 1, 1) == 0);
    CHECK(ecount == 6);
    CHECK(secp256k1_pedersen_blind_sum(CTX, blind_out, &blind_ptr, 0, 1) == 0);
    CHECK(ecount == 7);
    CHECK(secp256k1_pedersen_blind_sum(CTX, blind_out, &blind_ptr, 0, 0) != 0);
    CHECK(ecount == 7);
    CHECK(secp256k1_pedersen_commit(CTX, &commit, blind, val, secp256k1_generator_h) != 0);
    CHECK(secp256k1_pedersen_verify_tally(CTX, &commit_ptr, 1, &commit_ptr, 1) != 0);
    CHECK(secp256k1_pedersen_verify_tally(CTX, NULL, 0, &commit_ptr, 1) == 0);
    CHECK(secp256k1_pedersen_verify_tally(CTX, &commit_ptr, 1, NULL, 0) == 0);
    CHECK(secp256k1_pedersen_verify_tally(CTX, NULL, 0, NULL, 0) != 0);
-    CHECK(ecount == 7);
+    CHECK_ILLEGAL(CTX, secp256k1_pedersen_verify_tally(CTX, NULL, 1, &commit_ptr, 1));
-    CHECK(secp256k1_pedersen_verify_tally(CTX, NULL, 1, &commit_ptr, 1) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_pedersen_verify_tally(CTX, &commit_ptr, 1, NULL, 1));
    CHECK(ecount == 8);
    CHECK(secp256k1_pedersen_verify_tally(CTX, &commit_ptr, 1, NULL, 1) == 0);
    CHECK(ecount == 9);
    CHECK(secp256k1_pedersen_blind_generator_blind_sum(CTX, &val, &blind_ptr, &blind_out_ptr, 1, 0) != 0);
-    CHECK(ecount == 9);
+    CHECK_ILLEGAL(CTX, secp256k1_pedersen_blind_generator_blind_sum(CTX, &val, &blind_ptr, &blind_out_ptr, 1, 1));
-    CHECK(secp256k1_pedersen_blind_generator_blind_sum(CTX, &val, &blind_ptr, &blind_out_ptr, 1, 1) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_pedersen_blind_generator_blind_sum(CTX, &val, &blind_ptr, &blind_out_ptr, 0, 0));
-    CHECK(ecount == 10);
+    CHECK_ILLEGAL(CTX, secp256k1_pedersen_blind_generator_blind_sum(CTX, NULL, &blind_ptr, &blind_out_ptr, 1, 0));
-    CHECK(secp256k1_pedersen_blind_generator_blind_sum(CTX, &val, &blind_ptr, &blind_out_ptr, 0, 0) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_pedersen_blind_generator_blind_sum(CTX, &val, NULL, &blind_out_ptr, 1, 0));
-    CHECK(ecount == 11);
+    CHECK_ILLEGAL(CTX, secp256k1_pedersen_blind_generator_blind_sum(CTX, &val, &blind_ptr, NULL, 1, 0));
    CHECK(secp256k1_pedersen_blind_generator_blind_sum(CTX, NULL, &blind_ptr, &blind_out_ptr, 1, 0) == 0);
    CHECK(ecount == 12);
    CHECK(secp256k1_pedersen_blind_generator_blind_sum(CTX, &val, NULL, &blind_out_ptr, 1, 0) == 0);
    CHECK(ecount == 13);
    CHECK(secp256k1_pedersen_blind_generator_blind_sum(CTX, &val, &blind_ptr, NULL, 1, 0) == 0);
    CHECK(ecount == 14);
    secp256k1_context_set_error_callback(CTX, NULL, NULL);
    secp256k1_context_set_error_callback(STATIC_CTX, NULL, NULL);
    secp256k1_context_set_illegal_callback(CTX, NULL, NULL);
    secp256k1_context_set_illegal_callback(STATIC_CTX, NULL, NULL);
 }
 static void test_pedersen(void) {
--- a/src/modules/musig/session_impl.h
+++ b/src/modules/musig/session_impl.h
@ -574,8 +574,8 @@ int secp256k1_musig_partial_sign(const secp256k1_context* ctx, secp256k1_musig_p
        secp256k1_musig_partial_sign_clear(&sk, k);
        return 0;
    }
-    ARG_CHECK(secp256k1_fe_equal_var(&pk.x, &keypair_pk.x)
+    ARG_CHECK(secp256k1_fe_equal(&pk.x, &keypair_pk.x)
-              && secp256k1_fe_equal_var(&pk.y, &keypair_pk.y));
+              && secp256k1_fe_equal(&pk.y, &keypair_pk.y));
    if (!secp256k1_keyagg_cache_load(ctx, &cache_i, keyagg_cache)) {
        secp256k1_musig_partial_sign_clear(&sk, k);
        return 0;
--- a/src/modules/musig/tests_impl.h
+++ b/src/modules/musig/tests_impl.h
@ -160,13 +160,6 @@ static void musig_api_tests(secp256k1_scratch_space *scratch) {
    int i;
    /** setup **/
    int ecount;
    secp256k1_context_set_error_callback(CTX, counting_illegal_callback_fn, &ecount);
    secp256k1_context_set_error_callback(STATIC_CTX, counting_illegal_callback_fn, &ecount);
    secp256k1_context_set_illegal_callback(CTX, counting_illegal_callback_fn, &ecount);
    secp256k1_context_set_illegal_callback(STATIC_CTX, counting_illegal_callback_fn, &ecount);
    memset(max64, 0xff, sizeof(max64));
    memset(&invalid_keypair, 0, sizeof(invalid_keypair));
    memset(&invalid_pk, 0, sizeof(invalid_pk));
@ -206,7 +199,6 @@ static void musig_api_tests(secp256k1_scratch_space *scratch) {
    /** main test body **/
    /** Key aggregation **/
    ecount = 0;
    CHECK(secp256k1_musig_pubkey_agg(CTX, scratch, &agg_pk, &keyagg_cache, pk_ptr, 2) == 1);
    /* pubkey_agg does not require a scratch space */
    CHECK(secp256k1_musig_pubkey_agg(CTX, NULL, &agg_pk, &keyagg_cache, pk_ptr, 2) == 1);
@ -216,31 +208,23 @@ static void musig_api_tests(secp256k1_scratch_space *scratch) {
    secp256k1_scratch_space_destroy(CTX, scratch_small);
    CHECK(secp256k1_musig_pubkey_agg(CTX, scratch, NULL, &keyagg_cache, pk_ptr, 2) == 1);
    CHECK(secp256k1_musig_pubkey_agg(CTX, scratch, &agg_pk, NULL, pk_ptr, 2) == 1);
-    CHECK(secp256k1_musig_pubkey_agg(CTX, scratch, &agg_pk, &keyagg_cache, NULL, 2) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_pubkey_agg(CTX, scratch, &agg_pk, &keyagg_cache, NULL, 2));
    CHECK(ecount == 1);
    CHECK(memcmp_and_randomize(agg_pk.data, zeros132, sizeof(agg_pk.data)) == 0);
-    CHECK(secp256k1_musig_pubkey_agg(CTX, scratch, &agg_pk, &keyagg_cache, invalid_pk_ptr2, 2) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_pubkey_agg(CTX, scratch, &agg_pk, &keyagg_cache, invalid_pk_ptr2, 2));
    CHECK(ecount == 2);
    CHECK(memcmp_and_randomize(agg_pk.data, zeros132, sizeof(agg_pk.data)) == 0);
-    CHECK(secp256k1_musig_pubkey_agg(CTX, scratch, &agg_pk, &keyagg_cache, invalid_pk_ptr3, 3) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_pubkey_agg(CTX, scratch, &agg_pk, &keyagg_cache, invalid_pk_ptr3, 3));
    CHECK(ecount == 3);
    CHECK(memcmp_and_randomize(agg_pk.data, zeros132, sizeof(agg_pk.data)) == 0);
-    CHECK(secp256k1_musig_pubkey_agg(CTX, scratch, &agg_pk, &keyagg_cache, pk_ptr, 0) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_pubkey_agg(CTX, scratch, &agg_pk, &keyagg_cache, pk_ptr, 0));
    CHECK(ecount == 4);
    CHECK(memcmp_and_randomize(agg_pk.data, zeros132, sizeof(agg_pk.data)) == 0);
-    CHECK(secp256k1_musig_pubkey_agg(CTX, scratch, &agg_pk, &keyagg_cache, NULL, 0) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_pubkey_agg(CTX, scratch, &agg_pk, &keyagg_cache, NULL, 0));
    CHECK(ecount == 5);
    CHECK(memcmp_and_randomize(agg_pk.data, zeros132, sizeof(agg_pk.data)) == 0);
    CHECK(secp256k1_musig_pubkey_agg(CTX, scratch, &agg_pk, &keyagg_cache, pk_ptr, 2) == 1);
    /* pubkey_get */
    ecount = 0;
    CHECK(secp256k1_musig_pubkey_get(CTX, &full_agg_pk, &keyagg_cache) == 1);
-    CHECK(secp256k1_musig_pubkey_get(CTX, NULL, &keyagg_cache) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_pubkey_get(CTX, NULL, &keyagg_cache));
-    CHECK(ecount == 1);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_pubkey_get(CTX, &full_agg_pk, NULL));
    CHECK(secp256k1_musig_pubkey_get(CTX, &full_agg_pk, NULL) == 0);
    CHECK(ecount == 2);
    CHECK(secp256k1_memcmp_var(&full_agg_pk, zeros132, sizeof(full_agg_pk)) == 0);
    /** Tweaking **/
@ -251,7 +235,6 @@ static void musig_api_tests(secp256k1_scratch_space *scratch) {
        for (i = 0; i < 2; i++) {
            secp256k1_pubkey tmp_output_pk;
            secp256k1_musig_keyagg_cache tmp_keyagg_cache = keyagg_cache;
            ecount = 0;
            CHECK((*tweak_func[i])(CTX, &tmp_output_pk, &tmp_keyagg_cache, tweak) == 1);
            /* Reset keyagg_cache */
            tmp_keyagg_cache = keyagg_cache;
@ -259,88 +242,61 @@ static void musig_api_tests(secp256k1_scratch_space *scratch) {
            tmp_keyagg_cache = keyagg_cache;
            CHECK((*tweak_func[i])(CTX, NULL, &tmp_keyagg_cache, tweak) == 1);
            tmp_keyagg_cache = keyagg_cache;
-            CHECK((*tweak_func[i])(CTX, &tmp_output_pk, NULL, tweak) == 0);
+            CHECK_ILLEGAL(CTX, (*tweak_func[i])(CTX, &tmp_output_pk, NULL, tweak));
            CHECK(ecount == 1);
            CHECK(memcmp_and_randomize(tmp_output_pk.data, zeros132, sizeof(tmp_output_pk.data)) == 0);
            tmp_keyagg_cache = keyagg_cache;
-            CHECK((*tweak_func[i])(CTX, &tmp_output_pk, &tmp_keyagg_cache, NULL) == 0);
+            CHECK_ILLEGAL(CTX, (*tweak_func[i])(CTX, &tmp_output_pk, &tmp_keyagg_cache, NULL));
            CHECK(ecount == 2);
            CHECK(memcmp_and_randomize(tmp_output_pk.data, zeros132, sizeof(tmp_output_pk.data)) == 0);
            tmp_keyagg_cache = keyagg_cache;
            CHECK((*tweak_func[i])(CTX, &tmp_output_pk, &tmp_keyagg_cache, max64) == 0);
            CHECK(ecount == 2);
            CHECK(memcmp_and_randomize(tmp_output_pk.data, zeros132, sizeof(tmp_output_pk.data)) == 0);
            tmp_keyagg_cache = keyagg_cache;
            /* Uninitialized keyagg_cache */
-            CHECK((*tweak_func[i])(CTX, &tmp_output_pk, &invalid_keyagg_cache, tweak) == 0);
+            CHECK_ILLEGAL(CTX, (*tweak_func[i])(CTX, &tmp_output_pk, &invalid_keyagg_cache, tweak));
            CHECK(ecount == 3);
            CHECK(memcmp_and_randomize(tmp_output_pk.data, zeros132, sizeof(tmp_output_pk.data)) == 0);
        }
    }
    /** Session creation **/
    ecount = 0;
    CHECK(secp256k1_musig_nonce_gen(CTX, &secnonce[0], &pubnonce[0], session_id[0], sk[0], &pk[0], msg, &keyagg_cache, max64) == 1);
-    CHECK(ecount == 0);
+    CHECK_ILLEGAL(STATIC_CTX, secp256k1_musig_nonce_gen(STATIC_CTX, &secnonce[0], &pubnonce[0], session_id[0], sk[0], &pk[0], msg, &keyagg_cache, max64));
-    CHECK(secp256k1_musig_nonce_gen(STATIC_CTX, &secnonce[0], &pubnonce[0], session_id[0], sk[0], &pk[0], msg, &keyagg_cache, max64) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_nonce_gen(CTX, NULL, &pubnonce[0], session_id[0], sk[0], &pk[0], msg, &keyagg_cache, max64));
-    CHECK(ecount == 1);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_nonce_gen(CTX, &secnonce[0], NULL, session_id[0], sk[0], &pk[0], msg, &keyagg_cache, max64));
-    CHECK(secp256k1_musig_nonce_gen(CTX, NULL, &pubnonce[0], session_id[0], sk[0], &pk[0], msg, &keyagg_cache, max64) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_nonce_gen(CTX, &secnonce[0], &pubnonce[0], NULL, sk[0], &pk[0], msg, &keyagg_cache, max64));
    CHECK(ecount == 2);
    CHECK(secp256k1_musig_nonce_gen(CTX, &secnonce[0], NULL, session_id[0], sk[0], &pk[0], msg, &keyagg_cache, max64) == 0);
    CHECK(ecount == 3);
    CHECK(secp256k1_musig_nonce_gen(CTX, &secnonce[0], &pubnonce[0], NULL, sk[0], &pk[0], msg, &keyagg_cache, max64) == 0);
    CHECK(ecount == 4);
    CHECK(memcmp_and_randomize(secnonce[0].data, zeros132, sizeof(secnonce[0].data)) == 0);
    /* no seckey and session_id is 0 */
    CHECK(secp256k1_musig_nonce_gen(CTX, &secnonce[0], &pubnonce[0], zeros132, NULL, &pk[0], msg, &keyagg_cache, max64) == 0);
    CHECK(ecount == 4);
    CHECK(memcmp_and_randomize(secnonce[0].data, zeros132, sizeof(secnonce[0].data)) == 0);
    /* session_id 0 is fine when a seckey is provided */
    CHECK(secp256k1_musig_nonce_gen(CTX, &secnonce[0], &pubnonce[0], zeros132, sk[0], &pk[0], msg, &keyagg_cache, max64) == 1);
    CHECK(secp256k1_musig_nonce_gen(CTX, &secnonce[0], &pubnonce[0], session_id[0], NULL, &pk[0], msg, &keyagg_cache, max64) == 1);
    CHECK(ecount == 4);
    /* invalid seckey */
    CHECK(secp256k1_musig_nonce_gen(CTX, &secnonce[0], &pubnonce[0], session_id[0], max64, &pk[0], msg, &keyagg_cache, max64) == 0);
    CHECK(memcmp_and_randomize(secnonce[0].data, zeros132, sizeof(secnonce[0].data)) == 0);
-    CHECK(ecount == 4);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_nonce_gen(CTX, &secnonce[0], &pubnonce[0], session_id[0], sk[0], NULL, msg, &keyagg_cache, max64));
-    CHECK(secp256k1_musig_nonce_gen(CTX, &secnonce[0], &pubnonce[0], session_id[0], sk[0], NULL, msg, &keyagg_cache, max64) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_nonce_gen(CTX, &secnonce[0], &pubnonce[0], session_id[0], sk[0], &invalid_pk, msg, &keyagg_cache, max64));
    CHECK(ecount == 5);
    CHECK(secp256k1_musig_nonce_gen(CTX, &secnonce[0], &pubnonce[0], session_id[0], sk[0], &invalid_pk, msg, &keyagg_cache, max64) == 0);
    CHECK(ecount == 6);
    CHECK(secp256k1_musig_nonce_gen(CTX, &secnonce[0], &pubnonce[0], session_id[0], sk[0], &pk[0], NULL, &keyagg_cache, max64) == 1);
    CHECK(ecount == 6);
    CHECK(secp256k1_musig_nonce_gen(CTX, &secnonce[0], &pubnonce[0], session_id[0], sk[0], &pk[0], msg, NULL, max64) == 1);
-    CHECK(ecount == 6);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_nonce_gen(CTX, &secnonce[0], &pubnonce[0], session_id[0], sk[0], &pk[0], msg, &invalid_keyagg_cache, max64));
    CHECK(secp256k1_musig_nonce_gen(CTX, &secnonce[0], &pubnonce[0], session_id[0], sk[0], &pk[0], msg, &invalid_keyagg_cache, max64) == 0);
    CHECK(ecount == 7);
    CHECK(memcmp_and_randomize(secnonce[0].data, zeros132, sizeof(secnonce[0].data)) == 0);
    CHECK(secp256k1_musig_nonce_gen(CTX, &secnonce[0], &pubnonce[0], session_id[0], sk[0], &pk[0], msg, &keyagg_cache, NULL) == 1);
    CHECK(ecount == 7);
    /* Every in-argument except session_id and pubkey can be NULL */
    CHECK(secp256k1_musig_nonce_gen(CTX, &secnonce[0], &pubnonce[0], session_id[0], NULL, &pk[0], NULL, NULL, NULL) == 1);
    CHECK(secp256k1_musig_nonce_gen(CTX, &secnonce[1], &pubnonce[1], session_id[1], sk[1], &pk[1], NULL, NULL, NULL) == 1);
    /** Serialize and parse public nonces **/
-    ecount = 0;
+    CHECK_ILLEGAL(CTX, secp256k1_musig_pubnonce_serialize(CTX, NULL, &pubnonce[0]));
-    CHECK(secp256k1_musig_pubnonce_serialize(CTX, NULL, &pubnonce[0]) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_pubnonce_serialize(CTX, pubnonce_ser, NULL));
    CHECK(ecount == 1);
    CHECK(secp256k1_musig_pubnonce_serialize(CTX, pubnonce_ser, NULL) == 0);
    CHECK(ecount == 2);
    CHECK(memcmp_and_randomize(pubnonce_ser, zeros132, sizeof(pubnonce_ser)) == 0);
-    CHECK(secp256k1_musig_pubnonce_serialize(CTX, pubnonce_ser, &invalid_pubnonce) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_pubnonce_serialize(CTX, pubnonce_ser, &invalid_pubnonce));
    CHECK(ecount == 3);
    CHECK(memcmp_and_randomize(pubnonce_ser, zeros132, sizeof(pubnonce_ser)) == 0);
    CHECK(secp256k1_musig_pubnonce_serialize(CTX, pubnonce_ser, &pubnonce[0]) == 1);
    ecount = 0;
    CHECK(secp256k1_musig_pubnonce_parse(CTX, &pubnonce[0], pubnonce_ser) == 1);
-    CHECK(secp256k1_musig_pubnonce_parse(CTX, NULL, pubnonce_ser) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_pubnonce_parse(CTX, NULL, pubnonce_ser));
-    CHECK(ecount == 1);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_pubnonce_parse(CTX, &pubnonce[0], NULL));
    CHECK(secp256k1_musig_pubnonce_parse(CTX, &pubnonce[0], NULL) == 0);
    CHECK(ecount == 2);
    CHECK(secp256k1_musig_pubnonce_parse(CTX, &pubnonce[0], zeros132) == 0);
    CHECK(ecount == 2);
    CHECK(secp256k1_musig_pubnonce_parse(CTX, &pubnonce[0], pubnonce_ser) == 1);
    {
@ -352,16 +308,11 @@ static void musig_api_tests(secp256k1_scratch_space *scratch) {
    }
    /** Receive nonces and aggregate **/
    ecount = 0;
    CHECK(secp256k1_musig_nonce_agg(CTX, &aggnonce, pubnonce_ptr, 2) == 1);
-    CHECK(secp256k1_musig_nonce_agg(CTX, NULL, pubnonce_ptr, 2) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_nonce_agg(CTX, NULL, pubnonce_ptr, 2));
-    CHECK(ecount == 1);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_nonce_agg(CTX, &aggnonce, NULL, 2));
-    CHECK(secp256k1_musig_nonce_agg(CTX, &aggnonce, NULL, 2) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_nonce_agg(CTX, &aggnonce, pubnonce_ptr, 0));
-    CHECK(ecount == 2);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_nonce_agg(CTX, &aggnonce, invalid_pubnonce_ptr, 1));
    CHECK(secp256k1_musig_nonce_agg(CTX, &aggnonce, pubnonce_ptr, 0) == 0);
    CHECK(ecount == 3);
    CHECK(secp256k1_musig_nonce_agg(CTX, &aggnonce, invalid_pubnonce_ptr, 1) == 0);
    CHECK(ecount == 4);
    CHECK(secp256k1_musig_nonce_agg(CTX, &aggnonce, inf_pubnonce_ptr, 2) == 1);
    {
        /* Check that the aggnonce encodes two points at infinity */
@ -371,28 +322,20 @@ static void musig_api_tests(secp256k1_scratch_space *scratch) {
            secp256k1_ge_is_infinity(&aggnonce_pt[i]);
        }
    }
    CHECK(ecount == 4);
    CHECK(secp256k1_musig_nonce_agg(CTX, &aggnonce, pubnonce_ptr, 2) == 1);
    /** Serialize and parse aggregate nonces **/
    ecount = 0;
    CHECK(secp256k1_musig_aggnonce_serialize(CTX, aggnonce_ser, &aggnonce) == 1);
-    CHECK(secp256k1_musig_aggnonce_serialize(CTX, NULL, &aggnonce) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_aggnonce_serialize(CTX, NULL, &aggnonce));
-    CHECK(ecount == 1);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_aggnonce_serialize(CTX, aggnonce_ser, NULL));
    CHECK(secp256k1_musig_aggnonce_serialize(CTX, aggnonce_ser, NULL) == 0);
    CHECK(ecount == 2);
    CHECK(memcmp_and_randomize(aggnonce_ser, zeros132, sizeof(aggnonce_ser)) == 0);
-    CHECK(secp256k1_musig_aggnonce_serialize(CTX, aggnonce_ser, (secp256k1_musig_aggnonce*) &invalid_pubnonce) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_aggnonce_serialize(CTX, aggnonce_ser, (secp256k1_musig_aggnonce*) &invalid_pubnonce));
    CHECK(ecount == 3);
    CHECK(memcmp_and_randomize(aggnonce_ser, zeros132, sizeof(aggnonce_ser)) == 0);
    CHECK(secp256k1_musig_aggnonce_serialize(CTX, aggnonce_ser, &aggnonce) == 1);
    ecount = 0;
    CHECK(secp256k1_musig_aggnonce_parse(CTX, &aggnonce, aggnonce_ser) == 1);
-    CHECK(secp256k1_musig_aggnonce_parse(CTX, NULL, aggnonce_ser) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_aggnonce_parse(CTX, NULL, aggnonce_ser));
-    CHECK(ecount == 1);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_aggnonce_parse(CTX, &aggnonce, NULL));
    CHECK(secp256k1_musig_aggnonce_parse(CTX, &aggnonce, NULL) == 0);
    CHECK(ecount == 2);
    CHECK(secp256k1_musig_aggnonce_parse(CTX, &aggnonce, zeros132) == 1);
    CHECK(secp256k1_musig_aggnonce_parse(CTX, &aggnonce, aggnonce_ser) == 1);
@ -405,86 +348,59 @@ static void musig_api_tests(secp256k1_scratch_space *scratch) {
    }
    /** Process nonces **/
    ecount = 0;
    CHECK(secp256k1_musig_nonce_process(CTX, &session, &aggnonce, msg, &keyagg_cache, &adaptor) == 1);
-    CHECK(secp256k1_musig_nonce_process(CTX, NULL, &aggnonce, msg, &keyagg_cache, &adaptor) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_nonce_process(CTX, NULL, &aggnonce, msg, &keyagg_cache, &adaptor));
-    CHECK(ecount == 1);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_nonce_process(CTX, &session, NULL, msg, &keyagg_cache, &adaptor));
-    CHECK(secp256k1_musig_nonce_process(CTX, &session, NULL, msg, &keyagg_cache, &adaptor) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_nonce_process(CTX, &session, (secp256k1_musig_aggnonce*) &invalid_pubnonce, msg, &keyagg_cache, &adaptor));
-    CHECK(ecount == 2);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_nonce_process(CTX, &session, &aggnonce, NULL, &keyagg_cache, &adaptor));
-    CHECK(secp256k1_musig_nonce_process(CTX, &session, (secp256k1_musig_aggnonce*) &invalid_pubnonce, msg, &keyagg_cache, &adaptor) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_nonce_process(CTX, &session, &aggnonce, msg, NULL, &adaptor));
-    CHECK(ecount == 3);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_nonce_process(CTX, &session, &aggnonce, msg, &invalid_keyagg_cache, &adaptor));
    CHECK(secp256k1_musig_nonce_process(CTX, &session, &aggnonce, NULL, &keyagg_cache, &adaptor) == 0);
    CHECK(ecount == 4);
    CHECK(secp256k1_musig_nonce_process(CTX, &session, &aggnonce, msg, NULL, &adaptor) == 0);
    CHECK(ecount == 5);
    CHECK(secp256k1_musig_nonce_process(CTX, &session, &aggnonce, msg, &invalid_keyagg_cache, &adaptor) == 0);
    CHECK(ecount == 6);
    CHECK(secp256k1_musig_nonce_process(CTX, &session, &aggnonce, msg, &keyagg_cache, NULL) == 1);
-    CHECK(ecount == 6);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_nonce_process(CTX, &session, &aggnonce, msg, &keyagg_cache, (secp256k1_pubkey *)&invalid_pk));
    CHECK(secp256k1_musig_nonce_process(CTX, &session, &aggnonce, msg, &keyagg_cache, (secp256k1_pubkey *)&invalid_pk) == 0);
    CHECK(ecount == 7);
    CHECK(secp256k1_musig_nonce_process(CTX, &session, &aggnonce, msg, &keyagg_cache, &adaptor) == 1);
    ecount = 0;
    memcpy(&secnonce_tmp, &secnonce[0], sizeof(secnonce_tmp));
    CHECK(secp256k1_musig_partial_sign(CTX, &partial_sig[0], &secnonce_tmp, &keypair[0], &keyagg_cache, &session) == 1);
    /* The secnonce is set to 0 and subsequent signing attempts fail */
    CHECK(secp256k1_memcmp_var(&secnonce_tmp, zeros132, sizeof(secnonce_tmp)) == 0);
-    CHECK(secp256k1_musig_partial_sign(CTX, &partial_sig[0], &secnonce_tmp, &keypair[0], &keyagg_cache, &session) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_partial_sign(CTX, &partial_sig[0], &secnonce_tmp, &keypair[0], &keyagg_cache, &session));
    CHECK(ecount == 1);
    memcpy(&secnonce_tmp, &secnonce[0], sizeof(secnonce_tmp));
-    CHECK(secp256k1_musig_partial_sign(CTX, NULL, &secnonce_tmp, &keypair[0], &keyagg_cache, &session) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_partial_sign(CTX, NULL, &secnonce_tmp, &keypair[0], &keyagg_cache, &session));
    CHECK(ecount == 2);
    memcpy(&secnonce_tmp, &secnonce[0], sizeof(secnonce_tmp));
-    CHECK(secp256k1_musig_partial_sign(CTX, &partial_sig[0], NULL, &keypair[0], &keyagg_cache, &session) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_partial_sign(CTX, &partial_sig[0], NULL, &keypair[0], &keyagg_cache, &session));
-    CHECK(ecount == 3);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_partial_sign(CTX, &partial_sig[0], &invalid_secnonce, &keypair[0], &keyagg_cache, &session));
-    CHECK(secp256k1_musig_partial_sign(CTX, &partial_sig[0], &invalid_secnonce, &keypair[0], &keyagg_cache, &session) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_partial_sign(CTX, &partial_sig[0], &secnonce_tmp, NULL, &keyagg_cache, &session));
    CHECK(ecount == 4);
    CHECK(secp256k1_musig_partial_sign(CTX, &partial_sig[0], &secnonce_tmp, NULL, &keyagg_cache, &session) == 0);
    CHECK(ecount == 5);
    memcpy(&secnonce_tmp, &secnonce[0], sizeof(secnonce_tmp));
-    CHECK(secp256k1_musig_partial_sign(CTX, &partial_sig[0], &secnonce_tmp, &invalid_keypair, &keyagg_cache, &session) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_partial_sign(CTX, &partial_sig[0], &secnonce_tmp, &invalid_keypair, &keyagg_cache, &session));
    CHECK(ecount == 6);
    memcpy(&secnonce_tmp, &secnonce[0], sizeof(secnonce_tmp));
    {
        unsigned char sk_tmp[32];
        secp256k1_keypair keypair_tmp;
        secp256k1_testrand256(sk_tmp);
        CHECK(secp256k1_keypair_create(CTX, &keypair_tmp, sk_tmp));
-        CHECK(secp256k1_musig_partial_sign(CTX, &partial_sig[0], &secnonce_tmp, &keypair_tmp, &keyagg_cache, &session) == 0);
+        CHECK_ILLEGAL(CTX, secp256k1_musig_partial_sign(CTX, &partial_sig[0], &secnonce_tmp, &keypair_tmp, &keyagg_cache, &session));
        CHECK(ecount == 7);
        memcpy(&secnonce_tmp, &secnonce[0], sizeof(secnonce_tmp));
    }
-    CHECK(secp256k1_musig_partial_sign(CTX, &partial_sig[0], &secnonce_tmp, &keypair[0], NULL, &session) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_partial_sign(CTX, &partial_sig[0], &secnonce_tmp, &keypair[0], NULL, &session));
    CHECK(ecount == 8);
    memcpy(&secnonce_tmp, &secnonce[0], sizeof(secnonce_tmp));
-    CHECK(secp256k1_musig_partial_sign(CTX, &partial_sig[0], &secnonce_tmp, &keypair[0], &invalid_keyagg_cache, &session) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_partial_sign(CTX, &partial_sig[0], &secnonce_tmp, &keypair[0], &invalid_keyagg_cache, &session));
    CHECK(ecount == 9);
    memcpy(&secnonce_tmp, &secnonce[0], sizeof(secnonce_tmp));
-    CHECK(secp256k1_musig_partial_sign(CTX, &partial_sig[0], &secnonce_tmp, &keypair[0], &keyagg_cache, NULL) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_partial_sign(CTX, &partial_sig[0], &secnonce_tmp, &keypair[0], &keyagg_cache, NULL));
    CHECK(ecount == 10);
    memcpy(&secnonce_tmp, &secnonce[0], sizeof(secnonce_tmp));
-    CHECK(secp256k1_musig_partial_sign(CTX, &partial_sig[0], &secnonce_tmp, &keypair[0], &keyagg_cache, &invalid_session) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_partial_sign(CTX, &partial_sig[0], &secnonce_tmp, &keypair[0], &keyagg_cache, &invalid_session));
    CHECK(ecount == 11);
    memcpy(&secnonce_tmp, &secnonce[0], sizeof(secnonce_tmp));
    CHECK(secp256k1_musig_partial_sign(CTX, &partial_sig[0], &secnonce[0], &keypair[0], &keyagg_cache, &session) == 1);
    CHECK(secp256k1_musig_partial_sign(CTX, &partial_sig[1], &secnonce[1], &keypair[1], &keyagg_cache, &session) == 1);
    ecount = 0;
    CHECK(secp256k1_musig_partial_sig_serialize(CTX, buf, &partial_sig[0]) == 1);
-    CHECK(secp256k1_musig_partial_sig_serialize(CTX, NULL, &partial_sig[0]) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_partial_sig_serialize(CTX, NULL, &partial_sig[0]));
-    CHECK(ecount == 1);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_partial_sig_serialize(CTX, buf, NULL));
    CHECK(secp256k1_musig_partial_sig_serialize(CTX, buf, NULL) == 0);
    CHECK(ecount == 2);
    CHECK(secp256k1_musig_partial_sig_parse(CTX, &partial_sig[0], buf) == 1);
-    CHECK(secp256k1_musig_partial_sig_parse(CTX, NULL, buf) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_partial_sig_parse(CTX, NULL, buf));
    CHECK(ecount == 3);
    CHECK(secp256k1_musig_partial_sig_parse(CTX, &partial_sig[0], max64) == 0);
-    CHECK(ecount == 3);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_partial_sig_parse(CTX, &partial_sig[0], NULL));
    CHECK(secp256k1_musig_partial_sig_parse(CTX, &partial_sig[0], NULL) == 0);
    CHECK(ecount == 4);
    {
        /* Check that serialize and parse results in the same value */
@ -495,75 +411,46 @@ static void musig_api_tests(secp256k1_scratch_space *scratch) {
    }
    /** Partial signature verification */
    ecount = 0;
    CHECK(secp256k1_musig_partial_sig_verify(CTX, &partial_sig[0], &pubnonce[0], &pk[0], &keyagg_cache, &session) == 1);
    CHECK(secp256k1_musig_partial_sig_verify(CTX, &partial_sig[1], &pubnonce[0], &pk[0], &keyagg_cache, &session) == 0);
-    CHECK(secp256k1_musig_partial_sig_verify(CTX, NULL, &pubnonce[0], &pk[0], &keyagg_cache, &session) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_partial_sig_verify(CTX, NULL, &pubnonce[0], &pk[0], &keyagg_cache, &session));
-    CHECK(ecount == 1);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_partial_sig_verify(CTX, &invalid_partial_sig, &pubnonce[0], &pk[0], &keyagg_cache, &session));
-    CHECK(secp256k1_musig_partial_sig_verify(CTX, &invalid_partial_sig, &pubnonce[0], &pk[0], &keyagg_cache, &session) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_partial_sig_verify(CTX, &partial_sig[0], NULL, &pk[0], &keyagg_cache, &session));
-    CHECK(ecount == 2);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_partial_sig_verify(CTX, &partial_sig[0], &invalid_pubnonce, &pk[0], &keyagg_cache, &session));
-    CHECK(secp256k1_musig_partial_sig_verify(CTX, &partial_sig[0], NULL, &pk[0], &keyagg_cache, &session) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_partial_sig_verify(CTX, &partial_sig[0], &pubnonce[0], NULL, &keyagg_cache, &session));
-    CHECK(ecount == 3);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_partial_sig_verify(CTX, &partial_sig[0], &pubnonce[0], &invalid_pk, &keyagg_cache, &session));
-    CHECK(secp256k1_musig_partial_sig_verify(CTX, &partial_sig[0], &invalid_pubnonce, &pk[0], &keyagg_cache, &session) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_partial_sig_verify(CTX, &partial_sig[0], &pubnonce[0], &pk[0], NULL, &session));
-    CHECK(ecount == 4);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_partial_sig_verify(CTX, &partial_sig[0], &pubnonce[0], &pk[0], &invalid_keyagg_cache, &session));
-    CHECK(secp256k1_musig_partial_sig_verify(CTX, &partial_sig[0], &pubnonce[0], NULL, &keyagg_cache, &session) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_partial_sig_verify(CTX, &partial_sig[0], &pubnonce[0], &pk[0], &keyagg_cache, NULL));
-    CHECK(ecount == 5);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_partial_sig_verify(CTX, &partial_sig[0], &pubnonce[0], &pk[0], &keyagg_cache, &invalid_session));
    CHECK(secp256k1_musig_partial_sig_verify(CTX, &partial_sig[0], &pubnonce[0], &invalid_pk, &keyagg_cache, &session) == 0);
    CHECK(ecount == 6);
    CHECK(secp256k1_musig_partial_sig_verify(CTX, &partial_sig[0], &pubnonce[0], &pk[0], NULL, &session) == 0);
    CHECK(ecount == 7);
    CHECK(secp256k1_musig_partial_sig_verify(CTX, &partial_sig[0], &pubnonce[0], &pk[0], &invalid_keyagg_cache, &session) == 0);
    CHECK(ecount == 8);
    CHECK(secp256k1_musig_partial_sig_verify(CTX, &partial_sig[0], &pubnonce[0], &pk[0], &keyagg_cache, NULL) == 0);
    CHECK(ecount == 9);
    CHECK(secp256k1_musig_partial_sig_verify(CTX, &partial_sig[0], &pubnonce[0], &pk[0], &keyagg_cache, &invalid_session) == 0);
    CHECK(ecount == 10);
    CHECK(secp256k1_musig_partial_sig_verify(CTX, &partial_sig[0], &pubnonce[0], &pk[0], &keyagg_cache, &session) == 1);
    CHECK(secp256k1_musig_partial_sig_verify(CTX, &partial_sig[1], &pubnonce[1], &pk[1], &keyagg_cache, &session) == 1);
    /** Signature aggregation and verification */
    ecount = 0;
    CHECK(secp256k1_musig_partial_sig_agg(CTX, pre_sig, &session, partial_sig_ptr, 2) == 1);
-    CHECK(secp256k1_musig_partial_sig_agg(CTX, NULL, &session, partial_sig_ptr, 2) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_partial_sig_agg(CTX, NULL, &session, partial_sig_ptr, 2));
-    CHECK(ecount == 1);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_partial_sig_agg(CTX, pre_sig, NULL, partial_sig_ptr, 2));
-    CHECK(secp256k1_musig_partial_sig_agg(CTX, pre_sig, NULL, partial_sig_ptr, 2) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_partial_sig_agg(CTX, pre_sig, &invalid_session, partial_sig_ptr, 2));
-    CHECK(ecount == 2);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_partial_sig_agg(CTX, pre_sig, &session, NULL, 2));
-    CHECK(secp256k1_musig_partial_sig_agg(CTX, pre_sig, &invalid_session, partial_sig_ptr, 2) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_partial_sig_agg(CTX, pre_sig, &session, invalid_partial_sig_ptr, 2));
-    CHECK(ecount == 3);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_partial_sig_agg(CTX, pre_sig, &session, partial_sig_ptr, 0));
    CHECK(secp256k1_musig_partial_sig_agg(CTX, pre_sig, &session, NULL, 2) == 0);
    CHECK(ecount == 4);
    CHECK(secp256k1_musig_partial_sig_agg(CTX, pre_sig, &session, invalid_partial_sig_ptr, 2) == 0);
    CHECK(ecount == 5);
    CHECK(secp256k1_musig_partial_sig_agg(CTX, pre_sig, &session, partial_sig_ptr, 0) == 0);
    CHECK(ecount == 6);
    CHECK(secp256k1_musig_partial_sig_agg(CTX, pre_sig, &session, partial_sig_ptr, 1) == 1);
    CHECK(secp256k1_musig_partial_sig_agg(CTX, pre_sig, &session, partial_sig_ptr, 2) == 1);
    /** Adaptor signature verification */
    ecount = 0;
    CHECK(secp256k1_musig_nonce_parity(CTX, &nonce_parity, &session) == 1);
-    CHECK(secp256k1_musig_nonce_parity(CTX, NULL, &session) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_nonce_parity(CTX, NULL, &session));
-    CHECK(ecount == 1);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_nonce_parity(CTX, &nonce_parity, NULL));
-    CHECK(secp256k1_musig_nonce_parity(CTX, &nonce_parity, NULL) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_nonce_parity(CTX, &nonce_parity, &invalid_session));
    CHECK(ecount == 2);
    CHECK(secp256k1_musig_nonce_parity(CTX, &nonce_parity, &invalid_session) == 0);
    CHECK(ecount == 3);
    ecount = 0;
    CHECK(secp256k1_musig_adapt(CTX, final_sig, pre_sig, sec_adaptor, nonce_parity) == 1);
-    CHECK(secp256k1_musig_adapt(CTX, NULL, pre_sig, sec_adaptor, 0) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_adapt(CTX, NULL, pre_sig, sec_adaptor, 0));
-    CHECK(ecount == 1);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_adapt(CTX, final_sig, NULL, sec_adaptor, 0));
    CHECK(secp256k1_musig_adapt(CTX, final_sig, NULL, sec_adaptor, 0) == 0);
    CHECK(ecount == 2);
    CHECK(secp256k1_musig_adapt(CTX, final_sig, max64, sec_adaptor, 0) == 0);
-    CHECK(ecount == 2);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_adapt(CTX, final_sig, pre_sig, NULL, 0));
    CHECK(secp256k1_musig_adapt(CTX, final_sig, pre_sig, NULL, 0) == 0);
    CHECK(ecount == 3);
    CHECK(secp256k1_musig_adapt(CTX, final_sig, pre_sig, max64, 0) == 0);
-    CHECK(ecount == 3);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_adapt(CTX, final_sig, pre_sig, sec_adaptor, 2));
    CHECK(secp256k1_musig_adapt(CTX, final_sig, pre_sig, sec_adaptor, 2) == 0);
    CHECK(ecount == 4);
    /* sig and pre_sig argument point to the same location */
    memcpy(final_sig, pre_sig, sizeof(final_sig));
    CHECK(secp256k1_musig_adapt(CTX, final_sig, final_sig, sec_adaptor, nonce_parity) == 1);
@ -573,29 +460,17 @@ static void musig_api_tests(secp256k1_scratch_space *scratch) {
    CHECK(secp256k1_schnorrsig_verify(CTX, final_sig, msg, sizeof(msg), &agg_pk) == 1);
    /** Secret adaptor can be extracted from signature */
    ecount = 0;
    CHECK(secp256k1_musig_extract_adaptor(CTX, sec_adaptor1, final_sig, pre_sig, nonce_parity) == 1);
    CHECK(secp256k1_memcmp_var(sec_adaptor, sec_adaptor1, 32) == 0);
    /* wrong nonce parity */
    CHECK(secp256k1_musig_extract_adaptor(CTX, sec_adaptor1, final_sig, pre_sig, !nonce_parity) == 1);
    CHECK(secp256k1_memcmp_var(sec_adaptor, sec_adaptor1, 32) != 0);
-    CHECK(secp256k1_musig_extract_adaptor(CTX, NULL, final_sig, pre_sig, 0) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_extract_adaptor(CTX, NULL, final_sig, pre_sig, 0));
-    CHECK(ecount == 1);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_extract_adaptor(CTX, sec_adaptor1, NULL, pre_sig, 0));
    CHECK(secp256k1_musig_extract_adaptor(CTX, sec_adaptor1, NULL, pre_sig, 0) == 0);
    CHECK(ecount == 2);
    CHECK(secp256k1_musig_extract_adaptor(CTX, sec_adaptor1, max64, pre_sig, 0) == 0);
-    CHECK(ecount == 2);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_extract_adaptor(CTX, sec_adaptor1, final_sig, NULL, 0));
    CHECK(secp256k1_musig_extract_adaptor(CTX, sec_adaptor1, final_sig, NULL, 0) == 0);
    CHECK(ecount == 3);
    CHECK(secp256k1_musig_extract_adaptor(CTX, sec_adaptor1, final_sig, max64, 0) == 0);
-    CHECK(ecount == 3);
+    CHECK_ILLEGAL(CTX, secp256k1_musig_extract_adaptor(CTX, sec_adaptor1, final_sig, pre_sig, 2));
    CHECK(secp256k1_musig_extract_adaptor(CTX, sec_adaptor1, final_sig, pre_sig, 2) == 0);
    CHECK(ecount == 4);
    secp256k1_context_set_error_callback(CTX, NULL, NULL);
    secp256k1_context_set_error_callback(STATIC_CTX, NULL, NULL);
    secp256k1_context_set_illegal_callback(CTX, NULL, NULL);
    secp256k1_context_set_illegal_callback(STATIC_CTX, NULL, NULL);
 }
 static void musig_nonce_bitflip(unsigned char **args, size_t n_flip, size_t n_bytes) {
@ -1148,18 +1023,11 @@ static void musig_test_vectors_signverify(void) {
        CHECK(secp256k1_ec_pubkey_parse(CTX, &pubkey, vector->pubkeys[0], sizeof(vector->pubkeys[0])));
        musig_test_set_secnonce(&secnonce, vector->secnonces[c->secnonce_index], &pubkey);
        {
            /* In the last test vector we sign with an invalid secnonce, which
             * triggers an illegal_callback. Hence, we need to use a custom
             * context that does not abort in this case. */
            secp256k1_context *ctx_tmp = secp256k1_context_create(SECP256K1_CONTEXT_NONE);
            int32_t ecount = 0;
            secp256k1_context_set_error_callback(ctx_tmp, counting_illegal_callback_fn, &ecount);
            secp256k1_context_set_illegal_callback(ctx_tmp, counting_illegal_callback_fn, &ecount);
        expected = c->error != MUSIG_SECNONCE;
-            CHECK(expected == secp256k1_musig_partial_sign(ctx_tmp, &partial_sig, &secnonce, &keypair, &keyagg_cache, &session));
+        if (expected) {
-            CHECK((!expected) == ecount);
+            CHECK(secp256k1_musig_partial_sign(CTX, &partial_sig, &secnonce, &keypair, &keyagg_cache, &session));
-            secp256k1_context_destroy(ctx_tmp);
+        } else {
            CHECK_ILLEGAL(CTX, secp256k1_musig_partial_sign(CTX, &partial_sig, &secnonce, &keypair, &keyagg_cache, &session));
        }
    }
    for (i = 0; i < sizeof(vector->verify_fail_case)/sizeof(vector->verify_fail_case[0]); i++) {
--- a/src/modules/rangeproof/tests_impl.h
+++ b/src/modules/rangeproof/tests_impl.h
@ -16,7 +16,7 @@
 #include "../../../include/secp256k1_rangeproof.h"
-static void test_rangeproof_api(const int32_t *ecount) {
+static void test_rangeproof_api(void) {
    unsigned char proof[5134];
    unsigned char blind[32];
    secp256k1_pedersen_commitment commit;
@ -33,32 +33,19 @@ static void test_rangeproof_api(const int32_t *ecount) {
    CHECK(secp256k1_pedersen_commit(CTX, &commit, blind, val, secp256k1_generator_h));
    CHECK(secp256k1_rangeproof_sign(CTX, proof, &len, vmin, &commit, blind, commit.data, 0, 0, val, message, mlen, ext_commit, ext_commit_len, secp256k1_generator_h) == 1);
-    CHECK(*ecount == 0);
+    CHECK_ILLEGAL(STATIC_CTX, secp256k1_rangeproof_sign(STATIC_CTX, proof, &len, vmin, &commit, blind, commit.data, 0, 0, val, message, mlen, ext_commit, ext_commit_len, secp256k1_generator_h));
    CHECK(secp256k1_rangeproof_sign(STATIC_CTX, proof, &len, vmin, &commit, blind, commit.data, 0, 0, val, message, mlen, ext_commit, ext_commit_len, secp256k1_generator_h) == 0);
    CHECK(*ecount == 1);
-    CHECK(secp256k1_rangeproof_sign(CTX, NULL, &len, vmin, &commit, blind, commit.data, 0, 0, val, message, mlen, ext_commit, ext_commit_len, secp256k1_generator_h) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_rangeproof_sign(CTX, NULL, &len, vmin, &commit, blind, commit.data, 0, 0, val, message, mlen, ext_commit, ext_commit_len, secp256k1_generator_h));
-    CHECK(*ecount == 2);
+    CHECK_ILLEGAL(CTX, secp256k1_rangeproof_sign(CTX, proof, NULL, vmin, &commit, blind, commit.data, 0, 0, val, message, mlen, ext_commit, ext_commit_len, secp256k1_generator_h));
-    CHECK(secp256k1_rangeproof_sign(CTX, proof, NULL, vmin, &commit, blind, commit.data, 0, 0, val, message, mlen, ext_commit, ext_commit_len, secp256k1_generator_h) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_rangeproof_sign(CTX, proof, &len, vmin, NULL, blind, commit.data, 0, 0, val, message, mlen, ext_commit, ext_commit_len, secp256k1_generator_h));
-    CHECK(*ecount == 3);
+    CHECK_ILLEGAL(CTX, secp256k1_rangeproof_sign(CTX, proof, &len, vmin, &commit, NULL, commit.data, 0, 0, val, message, mlen, ext_commit, ext_commit_len, secp256k1_generator_h));
-    CHECK(secp256k1_rangeproof_sign(CTX, proof, &len, vmin, NULL, blind, commit.data, 0, 0, val, message, mlen, ext_commit, ext_commit_len, secp256k1_generator_h) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_rangeproof_sign(CTX, proof, &len, vmin, &commit, blind, NULL, 0, 0, val, message, mlen, ext_commit, ext_commit_len, secp256k1_generator_h));
    CHECK(*ecount == 4);
    CHECK(secp256k1_rangeproof_sign(CTX, proof, &len, vmin, &commit, NULL, commit.data, 0, 0, val, message, mlen, ext_commit, ext_commit_len, secp256k1_generator_h) == 0);
    CHECK(*ecount == 5);
    CHECK(secp256k1_rangeproof_sign(CTX, proof, &len, vmin, &commit, blind, NULL, 0, 0, val, message, mlen, ext_commit, ext_commit_len, secp256k1_generator_h) == 0);
    CHECK(*ecount == 6);
    CHECK(secp256k1_rangeproof_sign(CTX, proof, &len, vmin, &commit, blind, commit.data, 0, 0, vmin - 1, message, mlen, ext_commit, ext_commit_len, secp256k1_generator_h) == 0);
-    CHECK(*ecount == 6);
+    CHECK_ILLEGAL(CTX, secp256k1_rangeproof_sign(CTX, proof, &len, vmin, &commit, blind, commit.data, 0, 0, val, NULL, mlen, ext_commit, ext_commit_len, secp256k1_generator_h));
    CHECK(secp256k1_rangeproof_sign(CTX, proof, &len, vmin, &commit, blind, commit.data, 0, 0, val, NULL, mlen, ext_commit, ext_commit_len, secp256k1_generator_h) == 0);
    CHECK(*ecount == 7);
    CHECK(secp256k1_rangeproof_sign(CTX, proof, &len, vmin, &commit, blind, commit.data, 0, 0, val, NULL, 0, ext_commit, ext_commit_len, secp256k1_generator_h) != 0);
-    CHECK(*ecount == 7);
+    CHECK_ILLEGAL(CTX, secp256k1_rangeproof_sign(CTX, proof, &len, vmin, &commit, blind, commit.data, 0, 0, val, NULL, 0, NULL, ext_commit_len, secp256k1_generator_h));
    CHECK(secp256k1_rangeproof_sign(CTX, proof, &len, vmin, &commit, blind, commit.data, 0, 0, val, NULL, 0, NULL, ext_commit_len, secp256k1_generator_h) == 0);
    CHECK(*ecount == 8);
    CHECK(secp256k1_rangeproof_sign(CTX, proof, &len, vmin, &commit, blind, commit.data, 0, 0, val, NULL, 0, NULL, 0, secp256k1_generator_h) != 0);
-    CHECK(*ecount == 8);
+    CHECK_ILLEGAL(CTX, secp256k1_rangeproof_sign(CTX, proof, &len, vmin, &commit, blind, commit.data, 0, 0, val, NULL, 0, NULL, 0, NULL));
    CHECK(secp256k1_rangeproof_sign(CTX, proof, &len, vmin, &commit, blind, commit.data, 0, 0, val, NULL, 0, NULL, 0, NULL) == 0);
    CHECK(*ecount == 9);
    CHECK(secp256k1_rangeproof_sign(CTX, proof, &len, vmin, &commit, blind, commit.data, 0, 0, val, message, mlen, ext_commit, ext_commit_len, secp256k1_generator_h) != 0);
    {
@ -73,41 +60,26 @@ static void test_rangeproof_api(const int32_t *ecount) {
        CHECK(min_value == vmin);
        CHECK(max_value >= val);
-        CHECK(secp256k1_rangeproof_info(CTX, NULL, &mantissa, &min_value, &max_value, proof, len) == 0);
+        CHECK_ILLEGAL(CTX, secp256k1_rangeproof_info(CTX, NULL, &mantissa, &min_value, &max_value, proof, len));
-        CHECK(*ecount == 10);
+        CHECK_ILLEGAL(CTX, secp256k1_rangeproof_info(CTX, &exp, NULL, &min_value, &max_value, proof, len));
-        CHECK(secp256k1_rangeproof_info(CTX, &exp, NULL, &min_value, &max_value, proof, len) == 0);
+        CHECK_ILLEGAL(CTX, secp256k1_rangeproof_info(CTX, &exp, &mantissa, NULL, &max_value, proof, len));
-        CHECK(*ecount == 11);
+        CHECK_ILLEGAL(CTX, secp256k1_rangeproof_info(CTX, &exp, &mantissa, &min_value, NULL, proof, len));
-        CHECK(secp256k1_rangeproof_info(CTX, &exp, &mantissa, NULL, &max_value, proof, len) == 0);
+        CHECK_ILLEGAL(CTX, secp256k1_rangeproof_info(CTX, &exp, &mantissa, &min_value, &max_value, NULL, len));
        CHECK(*ecount == 12);
        CHECK(secp256k1_rangeproof_info(CTX, &exp, &mantissa, &min_value, NULL, proof, len) == 0);
        CHECK(*ecount == 13);
        CHECK(secp256k1_rangeproof_info(CTX, &exp, &mantissa, &min_value, &max_value, NULL, len) == 0);
        CHECK(*ecount == 14);
        CHECK(secp256k1_rangeproof_info(CTX, &exp, &mantissa, &min_value, &max_value, proof, 0) == 0);
        CHECK(*ecount == 14);
    }
    {
        uint64_t min_value;
        uint64_t max_value;
        CHECK(secp256k1_rangeproof_verify(CTX, &min_value, &max_value, &commit, proof, len, ext_commit, ext_commit_len, secp256k1_generator_h) == 1);
        CHECK(*ecount == 14);
-        CHECK(secp256k1_rangeproof_verify(CTX, NULL, &max_value, &commit, proof, len, ext_commit, ext_commit_len, secp256k1_generator_h) == 0);
+        CHECK_ILLEGAL(CTX, secp256k1_rangeproof_verify(CTX, NULL, &max_value, &commit, proof, len, ext_commit, ext_commit_len, secp256k1_generator_h));
-        CHECK(*ecount == 15);
+        CHECK_ILLEGAL(CTX, secp256k1_rangeproof_verify(CTX, &min_value, NULL, &commit, proof, len, ext_commit, ext_commit_len, secp256k1_generator_h));
-        CHECK(secp256k1_rangeproof_verify(CTX, &min_value, NULL, &commit, proof, len, ext_commit, ext_commit_len, secp256k1_generator_h) == 0);
+        CHECK_ILLEGAL(CTX, secp256k1_rangeproof_verify(CTX, &min_value, &max_value, NULL, proof, len, ext_commit, ext_commit_len, secp256k1_generator_h));
-        CHECK(*ecount == 16);
+        CHECK_ILLEGAL(CTX, secp256k1_rangeproof_verify(CTX, &min_value, &max_value, &commit, NULL, len, ext_commit, ext_commit_len, secp256k1_generator_h));
        CHECK(secp256k1_rangeproof_verify(CTX, &min_value, &max_value, NULL, proof, len, ext_commit, ext_commit_len, secp256k1_generator_h) == 0);
        CHECK(*ecount == 17);
        CHECK(secp256k1_rangeproof_verify(CTX, &min_value, &max_value, &commit, NULL, len, ext_commit, ext_commit_len, secp256k1_generator_h) == 0);
        CHECK(*ecount == 18);
        CHECK(secp256k1_rangeproof_verify(CTX, &min_value, &max_value, &commit, proof, 0, ext_commit, ext_commit_len, secp256k1_generator_h) == 0);
-        CHECK(*ecount == 18);
+        CHECK_ILLEGAL(CTX, secp256k1_rangeproof_verify(CTX, &min_value, &max_value, &commit, proof, len, NULL, ext_commit_len, secp256k1_generator_h));
        CHECK(secp256k1_rangeproof_verify(CTX, &min_value, &max_value, &commit, proof, len, NULL, ext_commit_len, secp256k1_generator_h) == 0);
        CHECK(*ecount == 19);
        CHECK(secp256k1_rangeproof_verify(CTX, &min_value, &max_value, &commit, proof, len, NULL, 0, secp256k1_generator_h) == 0);
-        CHECK(*ecount == 19);
+        CHECK_ILLEGAL(CTX, secp256k1_rangeproof_verify(CTX, &min_value, &max_value, &commit, proof, len, NULL, 0, NULL));
        CHECK(secp256k1_rangeproof_verify(CTX, &min_value, &max_value, &commit, proof, len, NULL, 0, NULL) == 0);
        CHECK(*ecount == 20);
    }
    {
        unsigned char blind_out[32];
@ -118,9 +90,7 @@ static void test_rangeproof_api(const int32_t *ecount) {
        size_t message_len = sizeof(message_out);
        CHECK(secp256k1_rangeproof_rewind(CTX, blind_out, &value_out, message_out, &message_len, commit.data, &min_value, &max_value, &commit, proof, len, ext_commit, ext_commit_len, secp256k1_generator_h) == 1);
-        CHECK(*ecount == 20);
+        CHECK_ILLEGAL(STATIC_CTX, secp256k1_rangeproof_rewind(STATIC_CTX, blind_out, &value_out, message_out, &message_len, commit.data, &min_value, &max_value, &commit, proof, len, ext_commit, ext_commit_len, secp256k1_generator_h));
        CHECK(secp256k1_rangeproof_rewind(STATIC_CTX, blind_out, &value_out, message_out, &message_len, commit.data, &min_value, &max_value, &commit, proof, len, ext_commit, ext_commit_len, secp256k1_generator_h) == 0);
        CHECK(*ecount == 21);
        CHECK(min_value == vmin);
        CHECK(max_value >= val);
@ -128,32 +98,21 @@ static void test_rangeproof_api(const int32_t *ecount) {
        CHECK(message_len == sizeof(message_out));
        CHECK(secp256k1_memcmp_var(message, message_out, sizeof(message_out)) == 0);
        /* blindout may be NULL */
        CHECK(secp256k1_rangeproof_rewind(CTX, NULL, &value_out, message_out, &message_len, commit.data, &min_value, &max_value, &commit, proof, len, ext_commit, ext_commit_len, secp256k1_generator_h) != 0);
-        CHECK(*ecount == 21);  /* blindout may be NULL */
+        /* valueout may be NULL */
        CHECK(secp256k1_rangeproof_rewind(CTX, blind_out, NULL, message_out, &message_len, commit.data, &min_value, &max_value, &commit, proof, len, ext_commit, ext_commit_len, secp256k1_generator_h) != 0);
-        CHECK(*ecount == 21);  /* valueout may be NULL */
+        CHECK_ILLEGAL(CTX, secp256k1_rangeproof_rewind(CTX, blind_out, &value_out, NULL, &message_len, commit.data, &min_value, &max_value, &commit, proof, len, ext_commit, ext_commit_len, secp256k1_generator_h));
        CHECK(secp256k1_rangeproof_rewind(CTX, blind_out, &value_out, NULL, &message_len, commit.data, &min_value, &max_value, &commit, proof, len, ext_commit, ext_commit_len, secp256k1_generator_h) == 0);
        CHECK(*ecount == 22);
        CHECK(secp256k1_rangeproof_rewind(CTX, blind_out, &value_out, NULL, 0, commit.data, &min_value, &max_value, &commit, proof, len, ext_commit, ext_commit_len, secp256k1_generator_h) != 0);
-        CHECK(*ecount == 22);
+        CHECK_ILLEGAL(CTX, secp256k1_rangeproof_rewind(CTX, blind_out, &value_out, NULL, 0, NULL, &min_value, &max_value, &commit, proof, len, ext_commit, ext_commit_len, secp256k1_generator_h));
-        CHECK(secp256k1_rangeproof_rewind(CTX, blind_out, &value_out, NULL, 0, NULL, &min_value, &max_value, &commit, proof, len, ext_commit, ext_commit_len, secp256k1_generator_h) == 0);
+        CHECK_ILLEGAL(CTX, secp256k1_rangeproof_rewind(CTX, blind_out, &value_out, NULL, 0, commit.data, NULL, &max_value, &commit, proof, len, ext_commit, ext_commit_len, secp256k1_generator_h));
-        CHECK(*ecount == 23);
+        CHECK_ILLEGAL(CTX, secp256k1_rangeproof_rewind(CTX, blind_out, &value_out, NULL, 0, commit.data, &min_value, NULL, &commit, proof, len, ext_commit, ext_commit_len, secp256k1_generator_h));
-        CHECK(secp256k1_rangeproof_rewind(CTX, blind_out, &value_out, NULL, 0, commit.data, NULL, &max_value, &commit, proof, len, ext_commit, ext_commit_len, secp256k1_generator_h) == 0);
+        CHECK_ILLEGAL(CTX, secp256k1_rangeproof_rewind(CTX, blind_out, &value_out, NULL, 0, commit.data, &min_value, &max_value, NULL, proof, len, ext_commit, ext_commit_len, secp256k1_generator_h));
-        CHECK(*ecount == 24);
+        CHECK_ILLEGAL(CTX, secp256k1_rangeproof_rewind(CTX, blind_out, &value_out, NULL, 0, commit.data, &min_value, &max_value, &commit, NULL, len, ext_commit, ext_commit_len, secp256k1_generator_h));
        CHECK(secp256k1_rangeproof_rewind(CTX, blind_out, &value_out, NULL, 0, commit.data, &min_value, NULL, &commit, proof, len, ext_commit, ext_commit_len, secp256k1_generator_h) == 0);
        CHECK(*ecount == 25);
        CHECK(secp256k1_rangeproof_rewind(CTX, blind_out, &value_out, NULL, 0, commit.data, &min_value, &max_value, NULL, proof, len, ext_commit, ext_commit_len, secp256k1_generator_h) == 0);
        CHECK(*ecount == 26);
        CHECK(secp256k1_rangeproof_rewind(CTX, blind_out, &value_out, NULL, 0, commit.data, &min_value, &max_value, &commit, NULL, len, ext_commit, ext_commit_len, secp256k1_generator_h) == 0);
        CHECK(*ecount == 27);
        CHECK(secp256k1_rangeproof_rewind(CTX, blind_out, &value_out, NULL, 0, commit.data, &min_value, &max_value, &commit, proof, 0, ext_commit, ext_commit_len, secp256k1_generator_h) == 0);
-        CHECK(*ecount == 27);
+        CHECK_ILLEGAL(CTX, secp256k1_rangeproof_rewind(CTX, blind_out, &value_out, NULL, 0, commit.data, &min_value, &max_value, &commit, proof, len, NULL, ext_commit_len, secp256k1_generator_h));
        CHECK(secp256k1_rangeproof_rewind(CTX, blind_out, &value_out, NULL, 0, commit.data, &min_value, &max_value, &commit, proof, len, NULL, ext_commit_len, secp256k1_generator_h) == 0);
        CHECK(*ecount == 28);
        CHECK(secp256k1_rangeproof_rewind(CTX, blind_out, &value_out, NULL, 0, commit.data, &min_value, &max_value, &commit, proof, len, NULL, 0, secp256k1_generator_h) == 0);
-        CHECK(*ecount == 28);
+        CHECK_ILLEGAL(CTX, secp256k1_rangeproof_rewind(CTX, blind_out, &value_out, NULL, 0, commit.data, &min_value, &max_value, &commit, proof, len, NULL, 0, NULL));
        CHECK(secp256k1_rangeproof_rewind(CTX, blind_out, &value_out, NULL, 0, commit.data, &min_value, &max_value, &commit, proof, len, NULL, 0, NULL) == 0);
        CHECK(*ecount == 29);
    }
    /* This constant is hardcoded in these tests and elsewhere, so we
@ -162,26 +121,6 @@ static void test_rangeproof_api(const int32_t *ecount) {
    CHECK(secp256k1_rangeproof_max_size(CTX, UINT64_MAX, 0) == 5134);
 }
 static void test_api(void) {
    int32_t ecount;
    int i;
    secp256k1_context_set_error_callback(CTX, counting_illegal_callback_fn, &ecount);
    secp256k1_context_set_error_callback(STATIC_CTX, counting_illegal_callback_fn, &ecount);
    secp256k1_context_set_illegal_callback(CTX, counting_illegal_callback_fn, &ecount);
    secp256k1_context_set_illegal_callback(STATIC_CTX, counting_illegal_callback_fn, &ecount);
    for (i = 0; i < COUNT; i++) {
        ecount = 0;
        test_rangeproof_api(&ecount);
    }
    secp256k1_context_set_error_callback(CTX, NULL, NULL);
    secp256k1_context_set_error_callback(STATIC_CTX, NULL, NULL);
    secp256k1_context_set_illegal_callback(CTX, NULL, NULL);
    secp256k1_context_set_illegal_callback(STATIC_CTX, NULL, NULL);
 }
 static void test_borromean(void) {
    unsigned char e0[32];
    secp256k1_scalar s[64];
@ -1384,7 +1323,9 @@ static void test_rangeproof_fixed_vectors_reproducible(void) {
 static void run_rangeproof_tests(void) {
    int i;
-    test_api();
+    for (i = 0; i < COUNT; i++) {
        test_rangeproof_api();
    }
    test_single_value_proof(0);
    test_single_value_proof(12345678);
--- a/src/modules/recovery/tests_impl.h
+++ b/src/modules/recovery/tests_impl.h
@ -36,7 +36,6 @@ static void test_ecdsa_recovery_api(void) {
    secp256k1_ecdsa_recoverable_signature recsig;
    unsigned char privkey[32] = { 1 };
    unsigned char message[32] = { 2 };
    int32_t ecount = 0;
    int recid = 0;
    unsigned char sig[74];
    unsigned char zero_privkey[32] = { 0 };
@ -45,86 +44,52 @@ static void test_ecdsa_recovery_api(void) {
                                       0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
                                       0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
    secp256k1_context_set_error_callback(CTX, counting_illegal_callback_fn, &ecount);
    secp256k1_context_set_illegal_callback(CTX, counting_illegal_callback_fn, &ecount);
    secp256k1_context_set_error_callback(STATIC_CTX, counting_illegal_callback_fn, &ecount);
    secp256k1_context_set_illegal_callback(STATIC_CTX, counting_illegal_callback_fn, &ecount);
    /* Construct and verify corresponding public key. */
    CHECK(secp256k1_ec_seckey_verify(CTX, privkey) == 1);
    CHECK(secp256k1_ec_pubkey_create(CTX, &pubkey, privkey) == 1);
    /* Check bad contexts and NULLs for signing */
    ecount = 0;
    CHECK(secp256k1_ecdsa_sign_recoverable(CTX, &recsig, message, privkey, NULL, NULL) == 1);
-    CHECK(ecount == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_sign_recoverable(CTX, NULL, message, privkey, NULL, NULL));
-    CHECK(secp256k1_ecdsa_sign_recoverable(CTX, NULL, message, privkey, NULL, NULL) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_sign_recoverable(CTX, &recsig, NULL, privkey, NULL, NULL));
-    CHECK(ecount == 1);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_sign_recoverable(CTX, &recsig, message, NULL, NULL, NULL));
-    CHECK(secp256k1_ecdsa_sign_recoverable(CTX, &recsig, NULL, privkey, NULL, NULL) == 0);
+    CHECK_ILLEGAL(STATIC_CTX, secp256k1_ecdsa_sign_recoverable(STATIC_CTX, &recsig, message, privkey, NULL, NULL));
    CHECK(ecount == 2);
    CHECK(secp256k1_ecdsa_sign_recoverable(CTX, &recsig, message, NULL, NULL, NULL) == 0);
    CHECK(ecount == 3);
    CHECK(secp256k1_ecdsa_sign_recoverable(STATIC_CTX, &recsig, message, privkey, NULL, NULL) == 0);
    CHECK(ecount == 4);
    /* This will fail or succeed randomly, and in either case will not ARG_CHECK failure */
    secp256k1_ecdsa_sign_recoverable(CTX, &recsig, message, privkey, recovery_test_nonce_function, NULL);
    CHECK(ecount == 4);
    /* These will all fail, but not in ARG_CHECK way */
    CHECK(secp256k1_ecdsa_sign_recoverable(CTX, &recsig, message, zero_privkey, NULL, NULL) == 0);
    CHECK(secp256k1_ecdsa_sign_recoverable(CTX, &recsig, message, over_privkey, NULL, NULL) == 0);
    /* This one will succeed. */
    CHECK(secp256k1_ecdsa_sign_recoverable(CTX, &recsig, message, privkey, NULL, NULL) == 1);
    CHECK(ecount == 4);
    /* Check signing with a goofy nonce function */
    /* Check bad contexts and NULLs for recovery */
    ecount = 0;
    CHECK(secp256k1_ecdsa_recover(CTX, &recpubkey, &recsig, message) == 1);
-    CHECK(ecount == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_recover(CTX, NULL, &recsig, message));
-    CHECK(secp256k1_ecdsa_recover(CTX, NULL, &recsig, message) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_recover(CTX, &recpubkey, NULL, message));
-    CHECK(ecount == 1);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_recover(CTX, &recpubkey, &recsig, NULL));
    CHECK(secp256k1_ecdsa_recover(CTX, &recpubkey, NULL, message) == 0);
    CHECK(ecount == 2);
    CHECK(secp256k1_ecdsa_recover(CTX, &recpubkey, &recsig, NULL) == 0);
    CHECK(ecount == 3);
    /* Check NULLs for conversion */
    CHECK(secp256k1_ecdsa_sign(CTX, &normal_sig, message, privkey, NULL, NULL) == 1);
-    ecount = 0;
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_recoverable_signature_convert(CTX, NULL, &recsig));
-    CHECK(secp256k1_ecdsa_recoverable_signature_convert(CTX, NULL, &recsig) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_recoverable_signature_convert(CTX, &normal_sig, NULL));
    CHECK(ecount == 1);
    CHECK(secp256k1_ecdsa_recoverable_signature_convert(CTX, &normal_sig, NULL) == 0);
    CHECK(ecount == 2);
    CHECK(secp256k1_ecdsa_recoverable_signature_convert(CTX, &normal_sig, &recsig) == 1);
    /* Check NULLs for de/serialization */
    CHECK(secp256k1_ecdsa_sign_recoverable(CTX, &recsig, message, privkey, NULL, NULL) == 1);
-    ecount = 0;
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_recoverable_signature_serialize_compact(CTX, NULL, &recid, &recsig));
-    CHECK(secp256k1_ecdsa_recoverable_signature_serialize_compact(CTX, NULL, &recid, &recsig) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_recoverable_signature_serialize_compact(CTX, sig, NULL, &recsig));
-    CHECK(ecount == 1);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_recoverable_signature_serialize_compact(CTX, sig, &recid, NULL));
    CHECK(secp256k1_ecdsa_recoverable_signature_serialize_compact(CTX, sig, NULL, &recsig) == 0);
    CHECK(ecount == 2);
    CHECK(secp256k1_ecdsa_recoverable_signature_serialize_compact(CTX, sig, &recid, NULL) == 0);
    CHECK(ecount == 3);
    CHECK(secp256k1_ecdsa_recoverable_signature_serialize_compact(CTX, sig, &recid, &recsig) == 1);
-    CHECK(secp256k1_ecdsa_recoverable_signature_parse_compact(CTX, NULL, sig, recid) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_recoverable_signature_parse_compact(CTX, NULL, sig, recid));
-    CHECK(ecount == 4);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_recoverable_signature_parse_compact(CTX, &recsig, NULL, recid));
-    CHECK(secp256k1_ecdsa_recoverable_signature_parse_compact(CTX, &recsig, NULL, recid) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_recoverable_signature_parse_compact(CTX, &recsig, sig, -1));
-    CHECK(ecount == 5);
+    CHECK_ILLEGAL(CTX, secp256k1_ecdsa_recoverable_signature_parse_compact(CTX, &recsig, sig, 5));
-    CHECK(secp256k1_ecdsa_recoverable_signature_parse_compact(CTX, &recsig, sig, -1) == 0);
+    /* overflow in signature will not result in calling illegal_callback */
    CHECK(ecount == 6);
    CHECK(secp256k1_ecdsa_recoverable_signature_parse_compact(CTX, &recsig, sig, 5) == 0);
    CHECK(ecount == 7);
    /* overflow in signature will fail but not affect ecount */
    memcpy(sig, over_privkey, 32);
    CHECK(secp256k1_ecdsa_recoverable_signature_parse_compact(CTX, &recsig, sig, recid) == 0);
    CHECK(ecount == 7);
    /* cleanup */
    secp256k1_context_set_error_callback(STATIC_CTX, NULL, NULL);
    secp256k1_context_set_illegal_callback(STATIC_CTX, NULL, NULL);
 }
 static void test_ecdsa_recovery_end_to_end(void) {
--- a/src/modules/schnorrsig/main_impl.h
+++ b/src/modules/schnorrsig/main_impl.h
@ -261,7 +261,7 @@ int secp256k1_schnorrsig_verify(const secp256k1_context* ctx, const unsigned cha
    secp256k1_fe_normalize_var(&r.y);
    return !secp256k1_fe_is_odd(&r.y) &&
-           secp256k1_fe_equal_var(&rx, &r.x);
+           secp256k1_fe_equal(&rx, &r.x);
 }
 #endif
--- a/src/modules/schnorrsig/tests_exhaustive_impl.h
+++ b/src/modules/schnorrsig/tests_exhaustive_impl.h
@ -110,15 +110,15 @@ static void test_exhaustive_schnorrsig_verify(const secp256k1_context *ctx, cons
                if (!e_done[e]) {
                    /* Iterate over the possible valid last 32 bytes in the signature.
                       0..order=that s value; order+1=random bytes */
-                    int count_valid = 0, s;
+                    int count_valid = 0;
                    unsigned int s;
                    for (s = 0; s <= EXHAUSTIVE_TEST_ORDER + 1; ++s) {
                        int expect_valid, valid;
                        if (s <= EXHAUSTIVE_TEST_ORDER) {
-                            secp256k1_scalar s_s;
+                            memset(sig64 + 32, 0, 32);
-                            secp256k1_scalar_set_int(&s_s, s);
+                            secp256k1_write_be32(sig64 + 60, s);
                            secp256k1_scalar_get_b32(sig64 + 32, &s_s);
                            expect_valid = actual_k != -1 && s != EXHAUSTIVE_TEST_ORDER &&
-                                           (s_s == (actual_k + actual_d * e) % EXHAUSTIVE_TEST_ORDER);
+                                           (s == (actual_k + actual_d * e) % EXHAUSTIVE_TEST_ORDER);
                        } else {
                            secp256k1_testrand256(sig64 + 32);
                            expect_valid = 0;
--- a/src/modules/schnorrsig/tests_impl.h
+++ b/src/modules/schnorrsig/tests_impl.h
@ -116,14 +116,6 @@ static void test_schnorrsig_api(void) {
    secp256k1_schnorrsig_extraparams extraparams = SECP256K1_SCHNORRSIG_EXTRAPARAMS_INIT;
    secp256k1_schnorrsig_extraparams invalid_extraparams = {{ 0 }, NULL, NULL};
    /** setup **/
    int ecount = 0;
    secp256k1_context_set_error_callback(CTX, counting_illegal_callback_fn, &ecount);
    secp256k1_context_set_illegal_callback(CTX, counting_illegal_callback_fn, &ecount);
    secp256k1_context_set_error_callback(STATIC_CTX, counting_illegal_callback_fn, &ecount);
    secp256k1_context_set_illegal_callback(STATIC_CTX, counting_illegal_callback_fn, &ecount);
    secp256k1_testrand256(sk1);
    secp256k1_testrand256(sk2);
    secp256k1_testrand256(sk3);
@ -137,57 +129,30 @@ static void test_schnorrsig_api(void) {
    memset(&zero_pk, 0, sizeof(zero_pk));
    /** main test body **/
    ecount = 0;
    CHECK(secp256k1_schnorrsig_sign32(CTX, sig, msg, &keypairs[0], NULL) == 1);
-    CHECK(ecount == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_schnorrsig_sign32(CTX, NULL, msg, &keypairs[0], NULL));
-    CHECK(secp256k1_schnorrsig_sign32(CTX, NULL, msg, &keypairs[0], NULL) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_schnorrsig_sign32(CTX, sig, NULL, &keypairs[0], NULL));
-    CHECK(ecount == 1);
+    CHECK_ILLEGAL(CTX, secp256k1_schnorrsig_sign32(CTX, sig, msg, NULL, NULL));
-    CHECK(secp256k1_schnorrsig_sign32(CTX, sig, NULL, &keypairs[0], NULL) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_schnorrsig_sign32(CTX, sig, msg, &invalid_keypair, NULL));
-    CHECK(ecount == 2);
+    CHECK_ILLEGAL(STATIC_CTX, secp256k1_schnorrsig_sign32(STATIC_CTX, sig, msg, &keypairs[0], NULL));
    CHECK(secp256k1_schnorrsig_sign32(CTX, sig, msg, NULL, NULL) == 0);
    CHECK(ecount == 3);
    CHECK(secp256k1_schnorrsig_sign32(CTX, sig, msg, &invalid_keypair, NULL) == 0);
    CHECK(ecount == 4);
    CHECK(secp256k1_schnorrsig_sign32(STATIC_CTX, sig, msg, &keypairs[0], NULL) == 0);
    CHECK(ecount == 5);
    ecount = 0;
    CHECK(secp256k1_schnorrsig_sign_custom(CTX, sig, msg, sizeof(msg), &keypairs[0], &extraparams) == 1);
-    CHECK(ecount == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_schnorrsig_sign_custom(CTX, NULL, msg, sizeof(msg), &keypairs[0], &extraparams));
-    CHECK(secp256k1_schnorrsig_sign_custom(CTX, NULL, msg, sizeof(msg), &keypairs[0], &extraparams) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_schnorrsig_sign_custom(CTX, sig, NULL, sizeof(msg), &keypairs[0], &extraparams));
    CHECK(ecount == 1);
    CHECK(secp256k1_schnorrsig_sign_custom(CTX, sig, NULL, sizeof(msg), &keypairs[0], &extraparams) == 0);
    CHECK(ecount == 2);
    CHECK(secp256k1_schnorrsig_sign_custom(CTX, sig, NULL, 0, &keypairs[0], &extraparams) == 1);
-    CHECK(ecount == 2);
+    CHECK_ILLEGAL(CTX, secp256k1_schnorrsig_sign_custom(CTX, sig, msg, sizeof(msg), NULL, &extraparams));
-    CHECK(secp256k1_schnorrsig_sign_custom(CTX, sig, msg, sizeof(msg), NULL, &extraparams) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_schnorrsig_sign_custom(CTX, sig, msg, sizeof(msg), &invalid_keypair, &extraparams));
    CHECK(ecount == 3);
    CHECK(secp256k1_schnorrsig_sign_custom(CTX, sig, msg, sizeof(msg), &invalid_keypair, &extraparams) == 0);
    CHECK(ecount == 4);
    CHECK(secp256k1_schnorrsig_sign_custom(CTX, sig, msg, sizeof(msg), &keypairs[0], NULL) == 1);
-    CHECK(ecount == 4);
+    CHECK_ILLEGAL(CTX, secp256k1_schnorrsig_sign_custom(CTX, sig, msg, sizeof(msg), &keypairs[0], &invalid_extraparams));
-    CHECK(secp256k1_schnorrsig_sign_custom(CTX, sig, msg, sizeof(msg), &keypairs[0], &invalid_extraparams) == 0);
+    CHECK_ILLEGAL(STATIC_CTX, secp256k1_schnorrsig_sign_custom(STATIC_CTX, sig, msg, sizeof(msg), &keypairs[0], &extraparams));
    CHECK(ecount == 5);
    CHECK(secp256k1_schnorrsig_sign_custom(STATIC_CTX, sig, msg, sizeof(msg), &keypairs[0], &extraparams) == 0);
    CHECK(ecount == 6);
    ecount = 0;
    CHECK(secp256k1_schnorrsig_sign32(CTX, sig, msg, &keypairs[0], NULL) == 1);
    CHECK(secp256k1_schnorrsig_verify(CTX, sig, msg, sizeof(msg), &pk[0]) == 1);
-    CHECK(ecount == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_schnorrsig_verify(CTX, NULL, msg, sizeof(msg), &pk[0]));
-    CHECK(secp256k1_schnorrsig_verify(CTX, NULL, msg, sizeof(msg), &pk[0]) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_schnorrsig_verify(CTX, sig, NULL, sizeof(msg), &pk[0]));
    CHECK(ecount == 1);
    CHECK(secp256k1_schnorrsig_verify(CTX, sig, NULL, sizeof(msg), &pk[0]) == 0);
    CHECK(ecount == 2);
    CHECK(secp256k1_schnorrsig_verify(CTX, sig, NULL, 0, &pk[0]) == 0);
-    CHECK(ecount == 2);
+    CHECK_ILLEGAL(CTX, secp256k1_schnorrsig_verify(CTX, sig, msg, sizeof(msg), NULL));
-    CHECK(secp256k1_schnorrsig_verify(CTX, sig, msg, sizeof(msg), NULL) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_schnorrsig_verify(CTX, sig, msg, sizeof(msg), &zero_pk));
    CHECK(ecount == 3);
    CHECK(secp256k1_schnorrsig_verify(CTX, sig, msg, sizeof(msg), &zero_pk) == 0);
    CHECK(ecount == 4);
    secp256k1_context_set_error_callback(STATIC_CTX, NULL, NULL);
    secp256k1_context_set_illegal_callback(STATIC_CTX, NULL, NULL);
 }
 /* Checks that hash initialized by secp256k1_schnorrsig_sha256_tagged has the
--- a/src/modules/surjection/tests_impl.h
+++ b/src/modules/surjection/tests_impl.h
@ -27,15 +27,9 @@ static void test_surjectionproof_api(void) {
    secp256k1_surjectionproof* proof_on_heap;
    size_t n_inputs = sizeof(fixed_input_tags) / sizeof(fixed_input_tags[0]);
    size_t input_index;
    int32_t ecount = 0;
    size_t i;
    secp256k1_testrand256(seed);
    secp256k1_context_set_error_callback(CTX, counting_illegal_callback_fn, &ecount);
    secp256k1_context_set_error_callback(STATIC_CTX, counting_illegal_callback_fn, &ecount);
    secp256k1_context_set_illegal_callback(CTX, counting_illegal_callback_fn, &ecount);
    secp256k1_context_set_illegal_callback(STATIC_CTX, counting_illegal_callback_fn, &ecount);
    for (i = 0; i < n_inputs; i++) {
        secp256k1_testrand256(input_blinding_key[i]);
@ -49,155 +43,99 @@ static void test_surjectionproof_api(void) {
    /* check allocate_initialized */
    CHECK(secp256k1_surjectionproof_allocate_initialized(CTX, &proof_on_heap, &input_index, fixed_input_tags, n_inputs, 0, &fixed_input_tags[0], 100, seed) == 0);
    CHECK(proof_on_heap == 0);
    CHECK(ecount == 0);
    CHECK(secp256k1_surjectionproof_allocate_initialized(CTX, &proof_on_heap, &input_index, fixed_input_tags, n_inputs, 3, &fixed_input_tags[0], 100, seed) != 0);
    CHECK(proof_on_heap != 0);
    secp256k1_surjectionproof_destroy(proof_on_heap);
-    CHECK(ecount == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_surjectionproof_allocate_initialized(CTX, NULL, &input_index, fixed_input_tags, n_inputs, 3, &fixed_input_tags[0], 100, seed));
-    CHECK(secp256k1_surjectionproof_allocate_initialized(CTX, NULL, &input_index, fixed_input_tags, n_inputs, 3, &fixed_input_tags[0], 100, seed) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_surjectionproof_allocate_initialized(CTX, &proof_on_heap, NULL, fixed_input_tags, n_inputs, 3, &fixed_input_tags[0], 100, seed));
    CHECK(ecount == 1);
    CHECK(secp256k1_surjectionproof_allocate_initialized(CTX, &proof_on_heap, NULL, fixed_input_tags, n_inputs, 3, &fixed_input_tags[0], 100, seed) == 0);
    CHECK(proof_on_heap == 0);
-    CHECK(ecount == 2);
+    CHECK_ILLEGAL(CTX, secp256k1_surjectionproof_allocate_initialized(CTX, &proof_on_heap, &input_index, NULL, n_inputs, 3, &fixed_input_tags[0], 100, seed));
    CHECK(secp256k1_surjectionproof_allocate_initialized(CTX, &proof_on_heap, &input_index, NULL, n_inputs, 3, &fixed_input_tags[0], 100, seed) == 0);
    CHECK(proof_on_heap == 0);
-    CHECK(ecount == 3);
+    CHECK_ILLEGAL(CTX, secp256k1_surjectionproof_allocate_initialized(CTX, &proof_on_heap, &input_index, fixed_input_tags, SECP256K1_SURJECTIONPROOF_MAX_N_INPUTS + 1, 3, &fixed_input_tags[0], 100, seed));
    CHECK(secp256k1_surjectionproof_allocate_initialized(CTX, &proof_on_heap, &input_index, fixed_input_tags, SECP256K1_SURJECTIONPROOF_MAX_N_INPUTS + 1, 3, &fixed_input_tags[0], 100, seed) == 0);
    CHECK(proof_on_heap == 0);
    CHECK(ecount == 4);
    CHECK(secp256k1_surjectionproof_allocate_initialized(CTX, &proof_on_heap, &input_index, fixed_input_tags, n_inputs, n_inputs, &fixed_input_tags[0], 100, seed) != 0);
    CHECK(proof_on_heap != 0);
    secp256k1_surjectionproof_destroy(proof_on_heap);
-    CHECK(ecount == 4);
+    CHECK_ILLEGAL(CTX, secp256k1_surjectionproof_allocate_initialized(CTX, &proof_on_heap, &input_index, fixed_input_tags, n_inputs, n_inputs + 1, &fixed_input_tags[0], 100, seed));
    CHECK(secp256k1_surjectionproof_allocate_initialized(CTX, &proof_on_heap, &input_index, fixed_input_tags, n_inputs, n_inputs + 1, &fixed_input_tags[0], 100, seed) == 0);
    CHECK(proof_on_heap == 0);
-    CHECK(ecount == 5);
+    CHECK_ILLEGAL(CTX, secp256k1_surjectionproof_allocate_initialized(CTX, &proof_on_heap, &input_index, fixed_input_tags, n_inputs, 3, NULL, 100, seed));
    CHECK(secp256k1_surjectionproof_allocate_initialized(CTX, &proof_on_heap, &input_index, fixed_input_tags, n_inputs, 3, NULL, 100, seed) == 0);
    CHECK(proof_on_heap == 0);
    CHECK(ecount == 6);
    CHECK((secp256k1_surjectionproof_allocate_initialized(CTX, &proof_on_heap, &input_index, fixed_input_tags, n_inputs, 0, &fixed_input_tags[0], 0, seed) & 1) == 0);
    CHECK(proof_on_heap == 0);
-    CHECK(ecount == 6);
+    CHECK_ILLEGAL(CTX, secp256k1_surjectionproof_allocate_initialized(CTX, &proof_on_heap, &input_index, fixed_input_tags, n_inputs, 0, &fixed_input_tags[0], 100, NULL));
    CHECK(secp256k1_surjectionproof_allocate_initialized(CTX, &proof_on_heap, &input_index, fixed_input_tags, n_inputs, 0, &fixed_input_tags[0], 100, NULL) == 0);
    CHECK(proof_on_heap == 0);
    CHECK(ecount == 7);
-    /* we are now going to test essentially the same functions, just without heap allocation.
+    /* we are now going to test essentially the same functions, just without
-     * reset ecount. */
+     * heap allocation. */
    ecount = 0;
    /* check initialize */
    CHECK(secp256k1_surjectionproof_initialize(CTX, &proof, &input_index, fixed_input_tags, n_inputs, 0, &fixed_input_tags[0], 100, seed) == 0);
    CHECK(ecount == 0);
    CHECK(secp256k1_surjectionproof_initialize(CTX, &proof, &input_index, fixed_input_tags, n_inputs, 3, &fixed_input_tags[0], 100, seed) != 0);
-    CHECK(ecount == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_surjectionproof_initialize(CTX, NULL, &input_index, fixed_input_tags, n_inputs, 3, &fixed_input_tags[0], 100, seed));
-    CHECK(secp256k1_surjectionproof_initialize(CTX, NULL, &input_index, fixed_input_tags, n_inputs, 3, &fixed_input_tags[0], 100, seed) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_surjectionproof_initialize(CTX, &proof, NULL, fixed_input_tags, n_inputs, 3, &fixed_input_tags[0], 100, seed));
-    CHECK(ecount == 1);
+    CHECK_ILLEGAL(CTX, secp256k1_surjectionproof_initialize(CTX, &proof, &input_index, NULL, n_inputs, 3, &fixed_input_tags[0], 100, seed));
-    CHECK(secp256k1_surjectionproof_initialize(CTX, &proof, NULL, fixed_input_tags, n_inputs, 3, &fixed_input_tags[0], 100, seed) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_surjectionproof_initialize(CTX, &proof, &input_index, fixed_input_tags, SECP256K1_SURJECTIONPROOF_MAX_N_INPUTS + 1, 3, &fixed_input_tags[0], 100, seed));
    CHECK(ecount == 2);
    CHECK(secp256k1_surjectionproof_initialize(CTX, &proof, &input_index, NULL, n_inputs, 3, &fixed_input_tags[0], 100, seed) == 0);
    CHECK(ecount == 3);
    CHECK(secp256k1_surjectionproof_initialize(CTX, &proof, &input_index, fixed_input_tags, SECP256K1_SURJECTIONPROOF_MAX_N_INPUTS + 1, 3, &fixed_input_tags[0], 100, seed) == 0);
    CHECK(ecount == 4);
    CHECK(secp256k1_surjectionproof_initialize(CTX, &proof, &input_index, fixed_input_tags, n_inputs, n_inputs, &fixed_input_tags[0], 100, seed) != 0);
-    CHECK(ecount == 4);
+    CHECK_ILLEGAL(CTX, secp256k1_surjectionproof_initialize(CTX, &proof, &input_index, fixed_input_tags, n_inputs, n_inputs + 1, &fixed_input_tags[0], 100, seed));
-    CHECK(secp256k1_surjectionproof_initialize(CTX, &proof, &input_index, fixed_input_tags, n_inputs, n_inputs + 1, &fixed_input_tags[0], 100, seed) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_surjectionproof_initialize(CTX, &proof, &input_index, fixed_input_tags, n_inputs, 3, NULL, 100, seed));
    CHECK(ecount == 5);
    CHECK(secp256k1_surjectionproof_initialize(CTX, &proof, &input_index, fixed_input_tags, n_inputs, 3, NULL, 100, seed) == 0);
    CHECK(ecount == 6);
    CHECK((secp256k1_surjectionproof_initialize(CTX, &proof, &input_index, fixed_input_tags, n_inputs, 0, &fixed_input_tags[0], 0, seed) & 1) == 0);
-    CHECK(ecount == 6);
+    CHECK_ILLEGAL(CTX, secp256k1_surjectionproof_initialize(CTX, &proof, &input_index, fixed_input_tags, n_inputs, 0, &fixed_input_tags[0], 100, NULL));
    CHECK(secp256k1_surjectionproof_initialize(CTX, &proof, &input_index, fixed_input_tags, n_inputs, 0, &fixed_input_tags[0], 100, NULL) == 0);
    CHECK(ecount == 7);
    CHECK(secp256k1_surjectionproof_initialize(CTX, &proof, &input_index, fixed_input_tags, n_inputs, 3, &fixed_input_tags[0], 100, seed) != 0);
    /* check generate */
    CHECK(secp256k1_surjectionproof_generate(CTX, &proof, ephemeral_input_tags, n_inputs, &ephemeral_output_tag, 0, input_blinding_key[0], output_blinding_key) != 0);
-    CHECK(ecount == 7);
+    CHECK_ILLEGAL(STATIC_CTX, secp256k1_surjectionproof_generate(STATIC_CTX, &proof, ephemeral_input_tags, n_inputs, &ephemeral_output_tag, 0, input_blinding_key[0], output_blinding_key));
    CHECK(secp256k1_surjectionproof_generate(STATIC_CTX, &proof, ephemeral_input_tags, n_inputs, &ephemeral_output_tag, 0, input_blinding_key[0], output_blinding_key) == 0);
    CHECK(ecount == 8);
-    CHECK(secp256k1_surjectionproof_generate(CTX, NULL, ephemeral_input_tags, n_inputs, &ephemeral_output_tag, 0, input_blinding_key[0], output_blinding_key) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_surjectionproof_generate(CTX, NULL, ephemeral_input_tags, n_inputs, &ephemeral_output_tag, 0, input_blinding_key[0], output_blinding_key));
-    CHECK(ecount == 9);
+    CHECK_ILLEGAL(CTX, secp256k1_surjectionproof_generate(CTX, &proof, NULL, n_inputs, &ephemeral_output_tag, 0, input_blinding_key[0], output_blinding_key));
    CHECK(secp256k1_surjectionproof_generate(CTX, &proof, NULL, n_inputs, &ephemeral_output_tag, 0, input_blinding_key[0], output_blinding_key) == 0);
    CHECK(ecount == 10);
    CHECK(secp256k1_surjectionproof_generate(CTX, &proof, ephemeral_input_tags, n_inputs + 1, &ephemeral_output_tag, 0, input_blinding_key[0], output_blinding_key) == 0);
    CHECK(ecount == 10);
    CHECK(secp256k1_surjectionproof_generate(CTX, &proof, ephemeral_input_tags, n_inputs - 1, &ephemeral_output_tag, 0, input_blinding_key[0], output_blinding_key) == 0);
    CHECK(ecount == 10);
    CHECK(secp256k1_surjectionproof_generate(CTX, &proof, ephemeral_input_tags, 0, &ephemeral_output_tag, 0, input_blinding_key[0], output_blinding_key) == 0);
-    CHECK(ecount == 10);
+    CHECK_ILLEGAL(CTX, secp256k1_surjectionproof_generate(CTX, &proof, ephemeral_input_tags, n_inputs, NULL, 0, input_blinding_key[0], output_blinding_key));
-    CHECK(secp256k1_surjectionproof_generate(CTX, &proof, ephemeral_input_tags, n_inputs, NULL, 0, input_blinding_key[0], output_blinding_key) == 0);
+    /* the below line "succeeds" but generates an invalid proof as the input_index is wrong. it is fairly expensive to detect this. should we? */
    CHECK(ecount == 11);
    CHECK(secp256k1_surjectionproof_generate(CTX, &proof, ephemeral_input_tags, n_inputs, &ephemeral_output_tag, 1, input_blinding_key[0], output_blinding_key) != 0);
    CHECK(ecount == 11);  /* the above line "succeeds" but generates an invalid proof as the input_index is wrong. it is fairly expensive to detect this. should we? */
    CHECK(secp256k1_surjectionproof_generate(CTX, &proof, ephemeral_input_tags, n_inputs, &ephemeral_output_tag, n_inputs + 1, input_blinding_key[0], output_blinding_key) != 0);
-    CHECK(ecount == 11);
+    CHECK_ILLEGAL(CTX, secp256k1_surjectionproof_generate(CTX, &proof, ephemeral_input_tags, n_inputs, &ephemeral_output_tag, 0, NULL, output_blinding_key));
-    CHECK(secp256k1_surjectionproof_generate(CTX, &proof, ephemeral_input_tags, n_inputs, &ephemeral_output_tag, 0, NULL, output_blinding_key) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_surjectionproof_generate(CTX, &proof, ephemeral_input_tags, n_inputs, &ephemeral_output_tag, 0, input_blinding_key[0], NULL));
    CHECK(ecount == 12);
    CHECK(secp256k1_surjectionproof_generate(CTX, &proof, ephemeral_input_tags, n_inputs, &ephemeral_output_tag, 0, input_blinding_key[0], NULL) == 0);
    CHECK(ecount == 13);
    CHECK(secp256k1_surjectionproof_generate(CTX, &proof, ephemeral_input_tags, n_inputs, &ephemeral_output_tag, 0, input_blinding_key[0], output_blinding_key) != 0);
    /* check verify */
    CHECK(secp256k1_surjectionproof_verify(CTX, &proof, ephemeral_input_tags, n_inputs, &ephemeral_output_tag) == 1);
    CHECK(ecount == 13);
-    CHECK(secp256k1_surjectionproof_verify(CTX, NULL, ephemeral_input_tags, n_inputs, &ephemeral_output_tag) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_surjectionproof_verify(CTX, NULL, ephemeral_input_tags, n_inputs, &ephemeral_output_tag));
-    CHECK(ecount == 14);
+    CHECK_ILLEGAL(CTX, secp256k1_surjectionproof_verify(CTX, &proof, NULL, n_inputs, &ephemeral_output_tag));
    CHECK(secp256k1_surjectionproof_verify(CTX, &proof, NULL, n_inputs, &ephemeral_output_tag) == 0);
    CHECK(ecount == 15);
    CHECK(secp256k1_surjectionproof_verify(CTX, &proof, ephemeral_input_tags, n_inputs - 1, &ephemeral_output_tag) == 0);
    CHECK(ecount == 15);
    CHECK(secp256k1_surjectionproof_verify(CTX, &proof, ephemeral_input_tags, n_inputs + 1, &ephemeral_output_tag) == 0);
-    CHECK(ecount == 15);
+    CHECK_ILLEGAL(CTX, secp256k1_surjectionproof_verify(CTX, &proof, ephemeral_input_tags, n_inputs, NULL));
    CHECK(secp256k1_surjectionproof_verify(CTX, &proof, ephemeral_input_tags, n_inputs, NULL) == 0);
    CHECK(ecount == 16);
    /* Test how surjectionproof_generate fails when the proof was not created
     * with surjectionproof_initialize */
    ecount = 0;
    CHECK(secp256k1_surjectionproof_generate(CTX, &proof, ephemeral_input_tags, n_inputs, &ephemeral_output_tag, 0, input_blinding_key[0], output_blinding_key) == 1);
    {
        secp256k1_surjectionproof tmp_proof = proof;
        tmp_proof.n_inputs = 0;
-        CHECK(secp256k1_surjectionproof_generate(CTX, &tmp_proof, ephemeral_input_tags, n_inputs, &ephemeral_output_tag, 0, input_blinding_key[0], output_blinding_key) == 0);
+        CHECK_ILLEGAL(CTX, secp256k1_surjectionproof_generate(CTX, &tmp_proof, ephemeral_input_tags, n_inputs, &ephemeral_output_tag, 0, input_blinding_key[0], output_blinding_key));
    }
    CHECK(ecount == 1);
    CHECK(secp256k1_surjectionproof_generate(CTX, &proof, ephemeral_input_tags, n_inputs, &ephemeral_output_tag, 0, input_blinding_key[0], output_blinding_key) == 1);
    /* Check serialize */
    ecount = 0;
    serialized_len = sizeof(serialized_proof);
    CHECK(secp256k1_surjectionproof_serialize(CTX, serialized_proof, &serialized_len, &proof) != 0);
    CHECK(ecount == 0);
    serialized_len = sizeof(serialized_proof);
-    CHECK(secp256k1_surjectionproof_serialize(CTX, NULL, &serialized_len, &proof) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_surjectionproof_serialize(CTX, NULL, &serialized_len, &proof));
    CHECK(ecount == 1);
    serialized_len = sizeof(serialized_proof);
-    CHECK(secp256k1_surjectionproof_serialize(CTX, serialized_proof, NULL, &proof) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_surjectionproof_serialize(CTX, serialized_proof, NULL, &proof));
    CHECK(ecount == 2);
    serialized_len = sizeof(serialized_proof);
-    CHECK(secp256k1_surjectionproof_serialize(CTX, serialized_proof, &serialized_len, NULL) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_surjectionproof_serialize(CTX, serialized_proof, &serialized_len, NULL));
    CHECK(ecount == 3);
    serialized_len = sizeof(serialized_proof);
    CHECK(secp256k1_surjectionproof_serialize(CTX, serialized_proof, &serialized_len, &proof) != 0);
    /* Check parse */
    CHECK(secp256k1_surjectionproof_parse(CTX, &proof, serialized_proof, serialized_len) != 0);
-    CHECK(ecount == 3);
+    CHECK_ILLEGAL(CTX, secp256k1_surjectionproof_parse(CTX, NULL, serialized_proof, serialized_len));
-    CHECK(secp256k1_surjectionproof_parse(CTX, NULL, serialized_proof, serialized_len) == 0);
+    CHECK_ILLEGAL(CTX, secp256k1_surjectionproof_parse(CTX, &proof, NULL, serialized_len));
    CHECK(ecount == 4);
    CHECK(secp256k1_surjectionproof_parse(CTX, &proof, NULL, serialized_len) == 0);
    CHECK(ecount == 5);
    CHECK(secp256k1_surjectionproof_parse(CTX, &proof, serialized_proof, 0) == 0);
    CHECK(ecount == 5);
    secp256k1_context_set_error_callback(CTX, NULL, NULL);
    secp256k1_context_set_error_callback(STATIC_CTX, NULL, NULL);
    secp256k1_context_set_illegal_callback(CTX, NULL, NULL);
    secp256k1_context_set_illegal_callback(STATIC_CTX, NULL, NULL);
 }
 static void test_input_selection(size_t n_inputs) {
--- a/src/scalar.h
+++ b/src/scalar.h
@ -105,4 +105,7 @@ static void secp256k1_scalar_mul_shift_var(secp256k1_scalar *r, const secp256k1_
 /** If flag is true, set *r equal to *a; otherwise leave it. Constant-time.  Both *r and *a must be initialized.*/
 static void secp256k1_scalar_cmov(secp256k1_scalar *r, const secp256k1_scalar *a, int flag);
 /** Check invariants on a scalar (no-op unless VERIFY is enabled). */
 static void secp256k1_scalar_verify(const secp256k1_scalar *r);
 #endif /* SECP256K1_SCALAR_H */
--- a/src/scalar_4x64_impl.h
+++ b/src/scalar_4x64_impl.h
@ -42,6 +42,8 @@ SECP256K1_INLINE static void secp256k1_scalar_set_int(secp256k1_scalar *r, unsig
    r->d[1] = 0;
    r->d[2] = 0;
    r->d[3] = 0;
    secp256k1_scalar_verify(r);
 }
 SECP256K1_INLINE static void secp256k1_scalar_set_u64(secp256k1_scalar *r, uint64_t v) {
@ -52,13 +54,17 @@ SECP256K1_INLINE static void secp256k1_scalar_set_u64(secp256k1_scalar *r, uint6
 }
 SECP256K1_INLINE static unsigned int secp256k1_scalar_get_bits(const secp256k1_scalar *a, unsigned int offset, unsigned int count) {
    secp256k1_scalar_verify(a);
    VERIFY_CHECK((offset + count - 1) >> 6 == offset >> 6);
    return (a->d[offset >> 6] >> (offset & 0x3F)) & ((((uint64_t)1) << count) - 1);
 }
 SECP256K1_INLINE static unsigned int secp256k1_scalar_get_bits_var(const secp256k1_scalar *a, unsigned int offset, unsigned int count) {
    secp256k1_scalar_verify(a);
    VERIFY_CHECK(count < 32);
    VERIFY_CHECK(offset + count <= 256);
    if ((offset + count - 1) >> 6 == offset >> 6) {
        return secp256k1_scalar_get_bits(a, offset, count);
    } else {
@ -82,6 +88,7 @@ SECP256K1_INLINE static int secp256k1_scalar_check_overflow(const secp256k1_scal
 SECP256K1_INLINE static int secp256k1_scalar_reduce(secp256k1_scalar *r, unsigned int overflow) {
    secp256k1_uint128 t;
    VERIFY_CHECK(overflow <= 1);
    secp256k1_u128_from_u64(&t, r->d[0]);
    secp256k1_u128_accum_u64(&t, overflow * SECP256K1_N_C_0);
    r->d[0] = secp256k1_u128_to_u64(&t); secp256k1_u128_rshift(&t, 64);
@ -93,12 +100,17 @@ SECP256K1_INLINE static int secp256k1_scalar_reduce(secp256k1_scalar *r, unsigne
    r->d[2] = secp256k1_u128_to_u64(&t); secp256k1_u128_rshift(&t, 64);
    secp256k1_u128_accum_u64(&t, r->d[3]);
    r->d[3] = secp256k1_u128_to_u64(&t);
    secp256k1_scalar_verify(r);
    return overflow;
 }
 static int secp256k1_scalar_add(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b) {
    int overflow;
    secp256k1_uint128 t;
    secp256k1_scalar_verify(a);
    secp256k1_scalar_verify(b);
    secp256k1_u128_from_u64(&t, a->d[0]);
    secp256k1_u128_accum_u64(&t, b->d[0]);
    r->d[0] = secp256k1_u128_to_u64(&t); secp256k1_u128_rshift(&t, 64);
@ -114,13 +126,17 @@ static int secp256k1_scalar_add(secp256k1_scalar *r, const secp256k1_scalar *a,
    overflow = secp256k1_u128_to_u64(&t) + secp256k1_scalar_check_overflow(r);
    VERIFY_CHECK(overflow == 0 || overflow == 1);
    secp256k1_scalar_reduce(r, overflow);
    secp256k1_scalar_verify(r);
    return overflow;
 }
 static void secp256k1_scalar_cadd_bit(secp256k1_scalar *r, unsigned int bit, int flag) {
    secp256k1_uint128 t;
    volatile int vflag = flag;
    secp256k1_scalar_verify(r);
    VERIFY_CHECK(bit < 256);
    bit += ((uint32_t) vflag - 1) & 0x100;  /* forcing (bit >> 6) > 3 makes this a noop */
    secp256k1_u128_from_u64(&t, r->d[0]);
    secp256k1_u128_accum_u64(&t, ((uint64_t)((bit >> 6) == 0)) << (bit & 0x3F));
@ -134,6 +150,8 @@ static void secp256k1_scalar_cadd_bit(secp256k1_scalar *r, unsigned int bit, int
    secp256k1_u128_accum_u64(&t, r->d[3]);
    secp256k1_u128_accum_u64(&t, ((uint64_t)((bit >> 6) == 3)) << (bit & 0x3F));
    r->d[3] = secp256k1_u128_to_u64(&t);
    secp256k1_scalar_verify(r);
 #ifdef VERIFY
    VERIFY_CHECK(secp256k1_u128_hi_u64(&t) == 0);
 #endif
@ -149,9 +167,13 @@ static void secp256k1_scalar_set_b32(secp256k1_scalar *r, const unsigned char *b
    if (overflow) {
        *overflow = over;
    }
    secp256k1_scalar_verify(r);
 }
 static void secp256k1_scalar_get_b32(unsigned char *bin, const secp256k1_scalar* a) {
    secp256k1_scalar_verify(a);
    secp256k1_write_be64(&bin[0],  a->d[3]);
    secp256k1_write_be64(&bin[8],  a->d[2]);
    secp256k1_write_be64(&bin[16], a->d[1]);
@ -159,12 +181,16 @@ static void secp256k1_scalar_get_b32(unsigned char *bin, const secp256k1_scalar*
 }
 SECP256K1_INLINE static int secp256k1_scalar_is_zero(const secp256k1_scalar *a) {
    secp256k1_scalar_verify(a);
    return (a->d[0] | a->d[1] | a->d[2] | a->d[3]) == 0;
 }
 static void secp256k1_scalar_negate(secp256k1_scalar *r, const secp256k1_scalar *a) {
    uint64_t nonzero = 0xFFFFFFFFFFFFFFFFULL * (secp256k1_scalar_is_zero(a) == 0);
    secp256k1_uint128 t;
    secp256k1_scalar_verify(a);
    secp256k1_u128_from_u64(&t, ~a->d[0]);
    secp256k1_u128_accum_u64(&t, SECP256K1_N_0 + 1);
    r->d[0] = secp256k1_u128_to_u64(&t) & nonzero; secp256k1_u128_rshift(&t, 64);
@ -177,15 +203,21 @@ static void secp256k1_scalar_negate(secp256k1_scalar *r, const secp256k1_scalar
    secp256k1_u128_accum_u64(&t, ~a->d[3]);
    secp256k1_u128_accum_u64(&t, SECP256K1_N_3);
    r->d[3] = secp256k1_u128_to_u64(&t) & nonzero;
    secp256k1_scalar_verify(r);
 }
 SECP256K1_INLINE static int secp256k1_scalar_is_one(const secp256k1_scalar *a) {
    secp256k1_scalar_verify(a);
    return ((a->d[0] ^ 1) | a->d[1] | a->d[2] | a->d[3]) == 0;
 }
 static int secp256k1_scalar_is_high(const secp256k1_scalar *a) {
    int yes = 0;
    int no = 0;
    secp256k1_scalar_verify(a);
    no |= (a->d[3] < SECP256K1_N_H_3);
    yes |= (a->d[3] > SECP256K1_N_H_3) & ~no;
    no |= (a->d[2] < SECP256K1_N_H_2) & ~yes; /* No need for a > check. */
@ -202,6 +234,8 @@ static int secp256k1_scalar_cond_negate(secp256k1_scalar *r, int flag) {
    uint64_t mask = -vflag;
    uint64_t nonzero = (secp256k1_scalar_is_zero(r) != 0) - 1;
    secp256k1_uint128 t;
    secp256k1_scalar_verify(r);
    secp256k1_u128_from_u64(&t, r->d[0] ^ mask);
    secp256k1_u128_accum_u64(&t, (SECP256K1_N_0 + 1) & mask);
    r->d[0] = secp256k1_u128_to_u64(&t) & nonzero; secp256k1_u128_rshift(&t, 64);
@ -214,6 +248,8 @@ static int secp256k1_scalar_cond_negate(secp256k1_scalar *r, int flag) {
    secp256k1_u128_accum_u64(&t, r->d[3] ^ mask);
    secp256k1_u128_accum_u64(&t, SECP256K1_N_3 & mask);
    r->d[3] = secp256k1_u128_to_u64(&t) & nonzero;
    secp256k1_scalar_verify(r);
    return 2 * (mask == 0) - 1;
 }
@ -933,19 +969,28 @@ static void secp256k1_scalar_sqr_512(uint64_t l[8], const secp256k1_scalar *a) {
 static void secp256k1_scalar_mul(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b) {
    uint64_t l[8];
    secp256k1_scalar_verify(a);
    secp256k1_scalar_verify(b);
    secp256k1_scalar_mul_512(l, a, b);
    secp256k1_scalar_reduce_512(r, l);
    secp256k1_scalar_verify(r);
 }
 static int secp256k1_scalar_shr_int(secp256k1_scalar *r, int n) {
    int ret;
    secp256k1_scalar_verify(r);
    VERIFY_CHECK(n > 0);
    VERIFY_CHECK(n < 16);
    ret = r->d[0] & ((1 << n) - 1);
    r->d[0] = (r->d[0] >> n) + (r->d[1] << (64 - n));
    r->d[1] = (r->d[1] >> n) + (r->d[2] << (64 - n));
    r->d[2] = (r->d[2] >> n) + (r->d[3] << (64 - n));
    r->d[3] = (r->d[3] >> n);
    secp256k1_scalar_verify(r);
    return ret;
 }
@ -956,6 +1001,8 @@ static void secp256k1_scalar_sqr(secp256k1_scalar *r, const secp256k1_scalar *a)
 }
 static void secp256k1_scalar_split_128(secp256k1_scalar *r1, secp256k1_scalar *r2, const secp256k1_scalar *k) {
    secp256k1_scalar_verify(k);
    r1->d[0] = k->d[0];
    r1->d[1] = k->d[1];
    r1->d[2] = 0;
@ -964,9 +1011,15 @@ static void secp256k1_scalar_split_128(secp256k1_scalar *r1, secp256k1_scalar *r
    r2->d[1] = k->d[3];
    r2->d[2] = 0;
    r2->d[3] = 0;
    secp256k1_scalar_verify(r1);
    secp256k1_scalar_verify(r2);
 }
 SECP256K1_INLINE static int secp256k1_scalar_eq(const secp256k1_scalar *a, const secp256k1_scalar *b) {
    secp256k1_scalar_verify(a);
    secp256k1_scalar_verify(b);
    return ((a->d[0] ^ b->d[0]) | (a->d[1] ^ b->d[1]) | (a->d[2] ^ b->d[2]) | (a->d[3] ^ b->d[3])) == 0;
 }
@ -975,7 +1028,10 @@ SECP256K1_INLINE static void secp256k1_scalar_mul_shift_var(secp256k1_scalar *r,
    unsigned int shiftlimbs;
    unsigned int shiftlow;
    unsigned int shifthigh;
    secp256k1_scalar_verify(a);
    secp256k1_scalar_verify(b);
    VERIFY_CHECK(shift >= 256);
    secp256k1_scalar_mul_512(l, a, b);
    shiftlimbs = shift >> 6;
    shiftlow = shift & 0x3F;
@ -985,18 +1041,24 @@ SECP256K1_INLINE static void secp256k1_scalar_mul_shift_var(secp256k1_scalar *r,
    r->d[2] = shift < 384 ? (l[2 + shiftlimbs] >> shiftlow | (shift < 320 && shiftlow ? (l[3 + shiftlimbs] << shifthigh) : 0)) : 0;
    r->d[3] = shift < 320 ? (l[3 + shiftlimbs] >> shiftlow) : 0;
    secp256k1_scalar_cadd_bit(r, 0, (l[(shift - 1) >> 6] >> ((shift - 1) & 0x3f)) & 1);
    secp256k1_scalar_verify(r);
 }
 static SECP256K1_INLINE void secp256k1_scalar_cmov(secp256k1_scalar *r, const secp256k1_scalar *a, int flag) {
    uint64_t mask0, mask1;
    volatile int vflag = flag;
    secp256k1_scalar_verify(a);
    SECP256K1_CHECKMEM_CHECK_VERIFY(r->d, sizeof(r->d));
    mask0 = vflag + ~((uint64_t)0);
    mask1 = ~mask0;
    r->d[0] = (r->d[0] & mask0) | (a->d[0] & mask1);
    r->d[1] = (r->d[1] & mask0) | (a->d[1] & mask1);
    r->d[2] = (r->d[2] & mask0) | (a->d[2] & mask1);
    r->d[3] = (r->d[3] & mask0) | (a->d[3] & mask1);
    secp256k1_scalar_verify(r);
 }
 static void secp256k1_scalar_from_signed62(secp256k1_scalar *r, const secp256k1_modinv64_signed62 *a) {
@ -1016,18 +1078,13 @@ static void secp256k1_scalar_from_signed62(secp256k1_scalar *r, const secp256k1_
    r->d[2] = a2 >> 4 | a3 << 58;
    r->d[3] = a3 >> 6 | a4 << 56;
-#ifdef VERIFY
+    secp256k1_scalar_verify(r);
    VERIFY_CHECK(secp256k1_scalar_check_overflow(r) == 0);
 #endif
 }
 static void secp256k1_scalar_to_signed62(secp256k1_modinv64_signed62 *r, const secp256k1_scalar *a) {
    const uint64_t M62 = UINT64_MAX >> 2;
    const uint64_t a0 = a->d[0], a1 = a->d[1], a2 = a->d[2], a3 = a->d[3];
-
+    secp256k1_scalar_verify(a);
 #ifdef VERIFY
    VERIFY_CHECK(secp256k1_scalar_check_overflow(a) == 0);
 #endif
    r->v[0] =  a0                   & M62;
    r->v[1] = (a0 >> 62 | a1 <<  2) & M62;
@ -1046,10 +1103,13 @@ static void secp256k1_scalar_inverse(secp256k1_scalar *r, const secp256k1_scalar
 #ifdef VERIFY
    int zero_in = secp256k1_scalar_is_zero(x);
 #endif
    secp256k1_scalar_verify(x);
    secp256k1_scalar_to_signed62(&s, x);
    secp256k1_modinv64(&s, &secp256k1_const_modinfo_scalar);
    secp256k1_scalar_from_signed62(r, &s);
    secp256k1_scalar_verify(r);
 #ifdef VERIFY
    VERIFY_CHECK(secp256k1_scalar_is_zero(r) == zero_in);
 #endif
@ -1060,16 +1120,21 @@ static void secp256k1_scalar_inverse_var(secp256k1_scalar *r, const secp256k1_sc
 #ifdef VERIFY
    int zero_in = secp256k1_scalar_is_zero(x);
 #endif
    secp256k1_scalar_verify(x);
    secp256k1_scalar_to_signed62(&s, x);
    secp256k1_modinv64_var(&s, &secp256k1_const_modinfo_scalar);
    secp256k1_scalar_from_signed62(r, &s);
    secp256k1_scalar_verify(r);
 #ifdef VERIFY
    VERIFY_CHECK(secp256k1_scalar_is_zero(r) == zero_in);
 #endif
 }
 SECP256K1_INLINE static int secp256k1_scalar_is_even(const secp256k1_scalar *a) {
    secp256k1_scalar_verify(a);
    return !(a->d[0] & 1);
 }
--- a/src/scalar_8x32_impl.h
+++ b/src/scalar_8x32_impl.h
@ -60,6 +60,8 @@ SECP256K1_INLINE static void secp256k1_scalar_set_int(secp256k1_scalar *r, unsig
    r->d[5] = 0;
    r->d[6] = 0;
    r->d[7] = 0;
    secp256k1_scalar_verify(r);
 }
 SECP256K1_INLINE static void secp256k1_scalar_set_u64(secp256k1_scalar *r, uint64_t v) {
@ -74,13 +76,17 @@ SECP256K1_INLINE static void secp256k1_scalar_set_u64(secp256k1_scalar *r, uint6
 }
 SECP256K1_INLINE static unsigned int secp256k1_scalar_get_bits(const secp256k1_scalar *a, unsigned int offset, unsigned int count) {
    secp256k1_scalar_verify(a);
    VERIFY_CHECK((offset + count - 1) >> 5 == offset >> 5);
    return (a->d[offset >> 5] >> (offset & 0x1F)) & ((1 << count) - 1);
 }
 SECP256K1_INLINE static unsigned int secp256k1_scalar_get_bits_var(const secp256k1_scalar *a, unsigned int offset, unsigned int count) {
    secp256k1_scalar_verify(a);
    VERIFY_CHECK(count < 32);
    VERIFY_CHECK(offset + count <= 256);
    if ((offset + count - 1) >> 5 == offset >> 5) {
        return secp256k1_scalar_get_bits(a, offset, count);
    } else {
@ -110,6 +116,7 @@ SECP256K1_INLINE static int secp256k1_scalar_check_overflow(const secp256k1_scal
 SECP256K1_INLINE static int secp256k1_scalar_reduce(secp256k1_scalar *r, uint32_t overflow) {
    uint64_t t;
    VERIFY_CHECK(overflow <= 1);
    t = (uint64_t)r->d[0] + overflow * SECP256K1_N_C_0;
    r->d[0] = t & 0xFFFFFFFFUL; t >>= 32;
    t += (uint64_t)r->d[1] + overflow * SECP256K1_N_C_1;
@ -126,12 +133,17 @@ SECP256K1_INLINE static int secp256k1_scalar_reduce(secp256k1_scalar *r, uint32_
    r->d[6] = t & 0xFFFFFFFFUL; t >>= 32;
    t += (uint64_t)r->d[7];
    r->d[7] = t & 0xFFFFFFFFUL;
    secp256k1_scalar_verify(r);
    return overflow;
 }
 static int secp256k1_scalar_add(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b) {
    int overflow;
    uint64_t t = (uint64_t)a->d[0] + b->d[0];
    secp256k1_scalar_verify(a);
    secp256k1_scalar_verify(b);
    r->d[0] = t & 0xFFFFFFFFULL; t >>= 32;
    t += (uint64_t)a->d[1] + b->d[1];
    r->d[1] = t & 0xFFFFFFFFULL; t >>= 32;
@ -150,13 +162,17 @@ static int secp256k1_scalar_add(secp256k1_scalar *r, const secp256k1_scalar *a,
    overflow = t + secp256k1_scalar_check_overflow(r);
    VERIFY_CHECK(overflow == 0 || overflow == 1);
    secp256k1_scalar_reduce(r, overflow);
    secp256k1_scalar_verify(r);
    return overflow;
 }
 static void secp256k1_scalar_cadd_bit(secp256k1_scalar *r, unsigned int bit, int flag) {
    uint64_t t;
    volatile int vflag = flag;
    secp256k1_scalar_verify(r);
    VERIFY_CHECK(bit < 256);
    bit += ((uint32_t) vflag - 1) & 0x100;  /* forcing (bit >> 5) > 7 makes this a noop */
    t = (uint64_t)r->d[0] + (((uint32_t)((bit >> 5) == 0)) << (bit & 0x1F));
    r->d[0] = t & 0xFFFFFFFFULL; t >>= 32;
@ -174,9 +190,10 @@ static void secp256k1_scalar_cadd_bit(secp256k1_scalar *r, unsigned int bit, int
    r->d[6] = t & 0xFFFFFFFFULL; t >>= 32;
    t += (uint64_t)r->d[7] + (((uint32_t)((bit >> 5) == 7)) << (bit & 0x1F));
    r->d[7] = t & 0xFFFFFFFFULL;
    secp256k1_scalar_verify(r);
 #ifdef VERIFY
    VERIFY_CHECK((t >> 32) == 0);
    VERIFY_CHECK(secp256k1_scalar_check_overflow(r) == 0);
 #endif
 }
@ -194,9 +211,13 @@ static void secp256k1_scalar_set_b32(secp256k1_scalar *r, const unsigned char *b
    if (overflow) {
        *overflow = over;
    }
    secp256k1_scalar_verify(r);
 }
 static void secp256k1_scalar_get_b32(unsigned char *bin, const secp256k1_scalar* a) {
    secp256k1_scalar_verify(a);
    secp256k1_write_be32(&bin[0], a->d[7]);
    secp256k1_write_be32(&bin[4], a->d[6]);
    secp256k1_write_be32(&bin[8], a->d[5]);
@ -208,12 +229,16 @@ static void secp256k1_scalar_get_b32(unsigned char *bin, const secp256k1_scalar*
 }
 SECP256K1_INLINE static int secp256k1_scalar_is_zero(const secp256k1_scalar *a) {
    secp256k1_scalar_verify(a);
    return (a->d[0] | a->d[1] | a->d[2] | a->d[3] | a->d[4] | a->d[5] | a->d[6] | a->d[7]) == 0;
 }
 static void secp256k1_scalar_negate(secp256k1_scalar *r, const secp256k1_scalar *a) {
    uint32_t nonzero = 0xFFFFFFFFUL * (secp256k1_scalar_is_zero(a) == 0);
    uint64_t t = (uint64_t)(~a->d[0]) + SECP256K1_N_0 + 1;
    secp256k1_scalar_verify(a);
    r->d[0] = t & nonzero; t >>= 32;
    t += (uint64_t)(~a->d[1]) + SECP256K1_N_1;
    r->d[1] = t & nonzero; t >>= 32;
@ -229,15 +254,21 @@ static void secp256k1_scalar_negate(secp256k1_scalar *r, const secp256k1_scalar
    r->d[6] = t & nonzero; t >>= 32;
    t += (uint64_t)(~a->d[7]) + SECP256K1_N_7;
    r->d[7] = t & nonzero;
    secp256k1_scalar_verify(r);
 }
 SECP256K1_INLINE static int secp256k1_scalar_is_one(const secp256k1_scalar *a) {
    secp256k1_scalar_verify(a);
    return ((a->d[0] ^ 1) | a->d[1] | a->d[2] | a->d[3] | a->d[4] | a->d[5] | a->d[6] | a->d[7]) == 0;
 }
 static int secp256k1_scalar_is_high(const secp256k1_scalar *a) {
    int yes = 0;
    int no = 0;
    secp256k1_scalar_verify(a);
    no |= (a->d[7] < SECP256K1_N_H_7);
    yes |= (a->d[7] > SECP256K1_N_H_7) & ~no;
    no |= (a->d[6] < SECP256K1_N_H_6) & ~yes; /* No need for a > check. */
@ -260,6 +291,8 @@ static int secp256k1_scalar_cond_negate(secp256k1_scalar *r, int flag) {
    uint32_t mask = -vflag;
    uint32_t nonzero = 0xFFFFFFFFUL * (secp256k1_scalar_is_zero(r) == 0);
    uint64_t t = (uint64_t)(r->d[0] ^ mask) + ((SECP256K1_N_0 + 1) & mask);
    secp256k1_scalar_verify(r);
    r->d[0] = t & nonzero; t >>= 32;
    t += (uint64_t)(r->d[1] ^ mask) + (SECP256K1_N_1 & mask);
    r->d[1] = t & nonzero; t >>= 32;
@ -275,6 +308,8 @@ static int secp256k1_scalar_cond_negate(secp256k1_scalar *r, int flag) {
    r->d[6] = t & nonzero; t >>= 32;
    t += (uint64_t)(r->d[7] ^ mask) + (SECP256K1_N_7 & mask);
    r->d[7] = t & nonzero;
    secp256k1_scalar_verify(r);
    return 2 * (mask == 0) - 1;
 }
@ -665,14 +700,21 @@ static void secp256k1_scalar_sqr_512(uint32_t *l, const secp256k1_scalar *a) {
 static void secp256k1_scalar_mul(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b) {
    uint32_t l[16];
    secp256k1_scalar_verify(a);
    secp256k1_scalar_verify(b);
    secp256k1_scalar_mul_512(l, a, b);
    secp256k1_scalar_reduce_512(r, l);
    secp256k1_scalar_verify(r);
 }
 static int secp256k1_scalar_shr_int(secp256k1_scalar *r, int n) {
    int ret;
    secp256k1_scalar_verify(r);
    VERIFY_CHECK(n > 0);
    VERIFY_CHECK(n < 16);
    ret = r->d[0] & ((1 << n) - 1);
    r->d[0] = (r->d[0] >> n) + (r->d[1] << (32 - n));
    r->d[1] = (r->d[1] >> n) + (r->d[2] << (32 - n));
@ -682,6 +724,8 @@ static int secp256k1_scalar_shr_int(secp256k1_scalar *r, int n) {
    r->d[5] = (r->d[5] >> n) + (r->d[6] << (32 - n));
    r->d[6] = (r->d[6] >> n) + (r->d[7] << (32 - n));
    r->d[7] = (r->d[7] >> n);
    secp256k1_scalar_verify(r);
    return ret;
 }
@ -692,6 +736,8 @@ static void secp256k1_scalar_sqr(secp256k1_scalar *r, const secp256k1_scalar *a)
 }
 static void secp256k1_scalar_split_128(secp256k1_scalar *r1, secp256k1_scalar *r2, const secp256k1_scalar *k) {
    secp256k1_scalar_verify(k);
    r1->d[0] = k->d[0];
    r1->d[1] = k->d[1];
    r1->d[2] = k->d[2];
@ -708,9 +754,15 @@ static void secp256k1_scalar_split_128(secp256k1_scalar *r1, secp256k1_scalar *r
    r2->d[5] = 0;
    r2->d[6] = 0;
    r2->d[7] = 0;
    secp256k1_scalar_verify(r1);
    secp256k1_scalar_verify(r2);
 }
 SECP256K1_INLINE static int secp256k1_scalar_eq(const secp256k1_scalar *a, const secp256k1_scalar *b) {
    secp256k1_scalar_verify(a);
    secp256k1_scalar_verify(b);
    return ((a->d[0] ^ b->d[0]) | (a->d[1] ^ b->d[1]) | (a->d[2] ^ b->d[2]) | (a->d[3] ^ b->d[3]) | (a->d[4] ^ b->d[4]) | (a->d[5] ^ b->d[5]) | (a->d[6] ^ b->d[6]) | (a->d[7] ^ b->d[7])) == 0;
 }
@ -719,7 +771,10 @@ SECP256K1_INLINE static void secp256k1_scalar_mul_shift_var(secp256k1_scalar *r,
    unsigned int shiftlimbs;
    unsigned int shiftlow;
    unsigned int shifthigh;
    secp256k1_scalar_verify(a);
    secp256k1_scalar_verify(b);
    VERIFY_CHECK(shift >= 256);
    secp256k1_scalar_mul_512(l, a, b);
    shiftlimbs = shift >> 5;
    shiftlow = shift & 0x1F;
@ -733,12 +788,16 @@ SECP256K1_INLINE static void secp256k1_scalar_mul_shift_var(secp256k1_scalar *r,
    r->d[6] = shift < 320 ? (l[6 + shiftlimbs] >> shiftlow | (shift < 288 && shiftlow ? (l[7 + shiftlimbs] << shifthigh) : 0)) : 0;
    r->d[7] = shift < 288 ? (l[7 + shiftlimbs] >> shiftlow)  : 0;
    secp256k1_scalar_cadd_bit(r, 0, (l[(shift - 1) >> 5] >> ((shift - 1) & 0x1f)) & 1);
    secp256k1_scalar_verify(r);
 }
 static SECP256K1_INLINE void secp256k1_scalar_cmov(secp256k1_scalar *r, const secp256k1_scalar *a, int flag) {
    uint32_t mask0, mask1;
    volatile int vflag = flag;
    secp256k1_scalar_verify(a);
    SECP256K1_CHECKMEM_CHECK_VERIFY(r->d, sizeof(r->d));
    mask0 = vflag + ~((uint32_t)0);
    mask1 = ~mask0;
    r->d[0] = (r->d[0] & mask0) | (a->d[0] & mask1);
@ -749,6 +808,8 @@ static SECP256K1_INLINE void secp256k1_scalar_cmov(secp256k1_scalar *r, const se
    r->d[5] = (r->d[5] & mask0) | (a->d[5] & mask1);
    r->d[6] = (r->d[6] & mask0) | (a->d[6] & mask1);
    r->d[7] = (r->d[7] & mask0) | (a->d[7] & mask1);
    secp256k1_scalar_verify(r);
 }
 static void secp256k1_scalar_from_signed30(secp256k1_scalar *r, const secp256k1_modinv32_signed30 *a) {
@ -777,19 +838,14 @@ static void secp256k1_scalar_from_signed30(secp256k1_scalar *r, const secp256k1_
    r->d[6] = a6 >> 12 | a7 << 18;
    r->d[7] = a7 >> 14 | a8 << 16;
-#ifdef VERIFY
+    secp256k1_scalar_verify(r);
    VERIFY_CHECK(secp256k1_scalar_check_overflow(r) == 0);
 #endif
 }
 static void secp256k1_scalar_to_signed30(secp256k1_modinv32_signed30 *r, const secp256k1_scalar *a) {
    const uint32_t M30 = UINT32_MAX >> 2;
    const uint32_t a0 = a->d[0], a1 = a->d[1], a2 = a->d[2], a3 = a->d[3],
                   a4 = a->d[4], a5 = a->d[5], a6 = a->d[6], a7 = a->d[7];
-
+    secp256k1_scalar_verify(a);
 #ifdef VERIFY
    VERIFY_CHECK(secp256k1_scalar_check_overflow(a) == 0);
 #endif
    r->v[0] =  a0                   & M30;
    r->v[1] = (a0 >> 30 | a1 <<  2) & M30;
@ -812,10 +868,13 @@ static void secp256k1_scalar_inverse(secp256k1_scalar *r, const secp256k1_scalar
 #ifdef VERIFY
    int zero_in = secp256k1_scalar_is_zero(x);
 #endif
    secp256k1_scalar_verify(x);
    secp256k1_scalar_to_signed30(&s, x);
    secp256k1_modinv32(&s, &secp256k1_const_modinfo_scalar);
    secp256k1_scalar_from_signed30(r, &s);
    secp256k1_scalar_verify(r);
 #ifdef VERIFY
    VERIFY_CHECK(secp256k1_scalar_is_zero(r) == zero_in);
 #endif
@ -826,16 +885,21 @@ static void secp256k1_scalar_inverse_var(secp256k1_scalar *r, const secp256k1_sc
 #ifdef VERIFY
    int zero_in = secp256k1_scalar_is_zero(x);
 #endif
    secp256k1_scalar_verify(x);
    secp256k1_scalar_to_signed30(&s, x);
    secp256k1_modinv32_var(&s, &secp256k1_const_modinfo_scalar);
    secp256k1_scalar_from_signed30(r, &s);
    secp256k1_scalar_verify(r);
 #ifdef VERIFY
    VERIFY_CHECK(secp256k1_scalar_is_zero(r) == zero_in);
 #endif
 }
 SECP256K1_INLINE static int secp256k1_scalar_is_even(const secp256k1_scalar *a) {
    secp256k1_scalar_verify(a);
    return !(a->d[0] & 1);
 }
--- a/src/scalar_impl.h
+++ b/src/scalar_impl.h
@ -30,9 +30,19 @@ static const secp256k1_scalar secp256k1_scalar_zero = SECP256K1_SCALAR_CONST(0,
 static int secp256k1_scalar_set_b32_seckey(secp256k1_scalar *r, const unsigned char *bin) {
    int overflow;
    secp256k1_scalar_set_b32(r, bin, &overflow);
    secp256k1_scalar_verify(r);
    return (!overflow) & (!secp256k1_scalar_is_zero(r));
 }
 static void secp256k1_scalar_verify(const secp256k1_scalar *r) {
 #ifdef VERIFY
    VERIFY_CHECK(secp256k1_scalar_check_overflow(r) == 0);
 #endif
    (void)r;
 }
 #if defined(EXHAUSTIVE_TEST_ORDER)
 /* Begin of section generated by sage/gen_exhaustive_groups.sage. */
 #  if EXHAUSTIVE_TEST_ORDER == 7
@ -53,11 +63,16 @@ static int secp256k1_scalar_set_b32_seckey(secp256k1_scalar *r, const unsigned c
 * (arbitrarily) set r2 = k + 5 (mod n) and r1 = k - r2 * lambda (mod n).
 */
 static void secp256k1_scalar_split_lambda(secp256k1_scalar * SECP256K1_RESTRICT r1, secp256k1_scalar * SECP256K1_RESTRICT r2, const secp256k1_scalar * SECP256K1_RESTRICT k) {
    secp256k1_scalar_verify(k);
    VERIFY_CHECK(r1 != k);
    VERIFY_CHECK(r2 != k);
    VERIFY_CHECK(r1 != r2);
    *r2 = (*k + 5) % EXHAUSTIVE_TEST_ORDER;
    *r1 = (*k + (EXHAUSTIVE_TEST_ORDER - *r2) * EXHAUSTIVE_TEST_LAMBDA) % EXHAUSTIVE_TEST_ORDER;
    secp256k1_scalar_verify(r1);
    secp256k1_scalar_verify(r2);
 }
 #else
 /**
@ -140,9 +155,11 @@ static void secp256k1_scalar_split_lambda(secp256k1_scalar * SECP256K1_RESTRICT
        0xE4437ED6UL, 0x010E8828UL, 0x6F547FA9UL, 0x0ABFE4C4UL,
        0x221208ACUL, 0x9DF506C6UL, 0x1571B4AEUL, 0x8AC47F71UL
    );
    secp256k1_scalar_verify(k);
    VERIFY_CHECK(r1 != k);
    VERIFY_CHECK(r2 != k);
    VERIFY_CHECK(r1 != r2);
    /* these _var calls are constant time since the shift amount is constant */
    secp256k1_scalar_mul_shift_var(&c1, k, &g1, 384);
    secp256k1_scalar_mul_shift_var(&c2, k, &g2, 384);
@ -153,6 +170,8 @@ static void secp256k1_scalar_split_lambda(secp256k1_scalar * SECP256K1_RESTRICT
    secp256k1_scalar_negate(r1, r1);
    secp256k1_scalar_add(r1, r1, k);
    secp256k1_scalar_verify(r1);
    secp256k1_scalar_verify(r2);
 #ifdef VERIFY
    secp256k1_scalar_split_lambda_verify(r1, r2, k);
 #endif
--- a/src/scalar_low_impl.h
+++ b/src/scalar_low_impl.h
@ -14,14 +14,28 @@
 #include <string.h>
 SECP256K1_INLINE static int secp256k1_scalar_is_even(const secp256k1_scalar *a) {
    secp256k1_scalar_verify(a);
    return !(*a & 1);
 }
 SECP256K1_INLINE static void secp256k1_scalar_clear(secp256k1_scalar *r) { *r = 0; }
-SECP256K1_INLINE static void secp256k1_scalar_set_int(secp256k1_scalar *r, unsigned int v) { *r = v; }
+
-SECP256K1_INLINE static void secp256k1_scalar_set_u64(secp256k1_scalar *r, uint64_t v) { *r = v % EXHAUSTIVE_TEST_ORDER; }
+SECP256K1_INLINE static void secp256k1_scalar_set_int(secp256k1_scalar *r, unsigned int v) {
    *r = v % EXHAUSTIVE_TEST_ORDER;
    secp256k1_scalar_verify(r);
 }
 SECP256K1_INLINE static void secp256k1_scalar_set_u64(secp256k1_scalar *r, uint64_t v) {
    *r = v % EXHAUSTIVE_TEST_ORDER;
    secp256k1_scalar_verify(r);
 }
 SECP256K1_INLINE static unsigned int secp256k1_scalar_get_bits(const secp256k1_scalar *a, unsigned int offset, unsigned int count) {
    secp256k1_scalar_verify(a);
    if (offset < 32)
        return ((*a >> offset) & ((((uint32_t)1) << count) - 1));
    else
@ -29,24 +43,34 @@ SECP256K1_INLINE static unsigned int secp256k1_scalar_get_bits(const secp256k1_s
 }
 SECP256K1_INLINE static unsigned int secp256k1_scalar_get_bits_var(const secp256k1_scalar *a, unsigned int offset, unsigned int count) {
    secp256k1_scalar_verify(a);
    return secp256k1_scalar_get_bits(a, offset, count);
 }
 SECP256K1_INLINE static int secp256k1_scalar_check_overflow(const secp256k1_scalar *a) { return *a >= EXHAUSTIVE_TEST_ORDER; }
 static int secp256k1_scalar_add(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b) {
    secp256k1_scalar_verify(a);
    secp256k1_scalar_verify(b);
    *r = (*a + *b) % EXHAUSTIVE_TEST_ORDER;
    secp256k1_scalar_verify(r);
    return *r < *b;
 }
 static void secp256k1_scalar_cadd_bit(secp256k1_scalar *r, unsigned int bit, int flag) {
    secp256k1_scalar_verify(r);
    if (flag && bit < 32)
        *r += ((uint32_t)1 << bit);
    secp256k1_scalar_verify(r);
 #ifdef VERIFY
    VERIFY_CHECK(bit < 32);
    /* Verify that adding (1 << bit) will not overflow any in-range scalar *r by overflowing the underlying uint32_t. */
    VERIFY_CHECK(((uint32_t)1 << bit) - 1 <= UINT32_MAX - EXHAUSTIVE_TEST_ORDER);
    VERIFY_CHECK(secp256k1_scalar_check_overflow(r) == 0);
 #endif
 }
@ -62,48 +86,75 @@ static void secp256k1_scalar_set_b32(secp256k1_scalar *r, const unsigned char *b
        }
    }
    if (overflow) *overflow = over;
    secp256k1_scalar_verify(r);
 }
 static void secp256k1_scalar_get_b32(unsigned char *bin, const secp256k1_scalar* a) {
    secp256k1_scalar_verify(a);
    memset(bin, 0, 32);
    bin[28] = *a >> 24; bin[29] = *a >> 16; bin[30] = *a >> 8; bin[31] = *a;
 }
 SECP256K1_INLINE static int secp256k1_scalar_is_zero(const secp256k1_scalar *a) {
    secp256k1_scalar_verify(a);
    return *a == 0;
 }
 static void secp256k1_scalar_negate(secp256k1_scalar *r, const secp256k1_scalar *a) {
    secp256k1_scalar_verify(a);
    if (*a == 0) {
        *r = 0;
    } else {
        *r = EXHAUSTIVE_TEST_ORDER - *a;
    }
    secp256k1_scalar_verify(r);
 }
 SECP256K1_INLINE static int secp256k1_scalar_is_one(const secp256k1_scalar *a) {
    secp256k1_scalar_verify(a);
    return *a == 1;
 }
 static int secp256k1_scalar_is_high(const secp256k1_scalar *a) {
    secp256k1_scalar_verify(a);
    return *a > EXHAUSTIVE_TEST_ORDER / 2;
 }
 static int secp256k1_scalar_cond_negate(secp256k1_scalar *r, int flag) {
    secp256k1_scalar_verify(r);
    if (flag) secp256k1_scalar_negate(r, r);
    secp256k1_scalar_verify(r);
    return flag ? -1 : 1;
 }
 static void secp256k1_scalar_mul(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b) {
    secp256k1_scalar_verify(a);
    secp256k1_scalar_verify(b);
    *r = (*a * *b) % EXHAUSTIVE_TEST_ORDER;
    secp256k1_scalar_verify(r);
 }
 static int secp256k1_scalar_shr_int(secp256k1_scalar *r, int n) {
    int ret;
    secp256k1_scalar_verify(r);
    VERIFY_CHECK(n > 0);
    VERIFY_CHECK(n < 16);
    ret = *r & ((1 << n) - 1);
    *r >>= n;
    secp256k1_scalar_verify(r);
    return ret;
 }
@ -112,36 +163,56 @@ static void secp256k1_scalar_sqr(secp256k1_scalar *r, const secp256k1_scalar *a)
 }
 static void secp256k1_scalar_split_128(secp256k1_scalar *r1, secp256k1_scalar *r2, const secp256k1_scalar *a) {
    secp256k1_scalar_verify(a);
    *r1 = *a;
    *r2 = 0;
    secp256k1_scalar_verify(r1);
    secp256k1_scalar_verify(r2);
 }
 SECP256K1_INLINE static int secp256k1_scalar_eq(const secp256k1_scalar *a, const secp256k1_scalar *b) {
    secp256k1_scalar_verify(a);
    secp256k1_scalar_verify(b);
    return *a == *b;
 }
 static SECP256K1_INLINE void secp256k1_scalar_cmov(secp256k1_scalar *r, const secp256k1_scalar *a, int flag) {
    uint32_t mask0, mask1;
    volatile int vflag = flag;
    secp256k1_scalar_verify(a);
    SECP256K1_CHECKMEM_CHECK_VERIFY(r, sizeof(*r));
    mask0 = vflag + ~((uint32_t)0);
    mask1 = ~mask0;
    *r = (*r & mask0) | (*a & mask1);
    secp256k1_scalar_verify(r);
 }
 static void secp256k1_scalar_inverse(secp256k1_scalar *r, const secp256k1_scalar *x) {
    int i;
    *r = 0;
    secp256k1_scalar_verify(x);
    for (i = 0; i < EXHAUSTIVE_TEST_ORDER; i++)
        if ((i * *x) % EXHAUSTIVE_TEST_ORDER == 1)
            *r = i;
    secp256k1_scalar_verify(r);
    /* If this VERIFY_CHECK triggers we were given a noninvertible scalar (and thus
     * have a composite group order; fix it in exhaustive_tests.c). */
    VERIFY_CHECK(*r != 0);
 }
 static void secp256k1_scalar_inverse_var(secp256k1_scalar *r, const secp256k1_scalar *x) {
    secp256k1_scalar_verify(x);
    secp256k1_scalar_inverse(r, x);
    secp256k1_scalar_verify(r);
 }
 #endif /* SECP256K1_SCALAR_REPR_IMPL_H */
--- a/src/tests.c
+++ b/src/tests.c
--- a/src/tests_exhaustive.c
+++ b/src/tests_exhaustive.c
@ -28,61 +28,11 @@
 #include "testrand_impl.h"
 #include "ecmult_compute_table_impl.h"
 #include "ecmult_gen_compute_table_impl.h"
 #include "testutil.h"
 #include "util.h"
 static int count = 2;
 /** stolen from tests.c */
 static void ge_equals_ge(const secp256k1_ge *a, const secp256k1_ge *b) {
    CHECK(a->infinity == b->infinity);
    if (a->infinity) {
        return;
    }
    CHECK(secp256k1_fe_equal_var(&a->x, &b->x));
    CHECK(secp256k1_fe_equal_var(&a->y, &b->y));
 }
 static void ge_equals_gej(const secp256k1_ge *a, const secp256k1_gej *b) {
    secp256k1_fe z2s;
    secp256k1_fe u1, u2, s1, s2;
    CHECK(a->infinity == b->infinity);
    if (a->infinity) {
        return;
    }
    /* Check a.x * b.z^2 == b.x && a.y * b.z^3 == b.y, to avoid inverses. */
    secp256k1_fe_sqr(&z2s, &b->z);
    secp256k1_fe_mul(&u1, &a->x, &z2s);
    u2 = b->x; secp256k1_fe_normalize_weak(&u2);
    secp256k1_fe_mul(&s1, &a->y, &z2s); secp256k1_fe_mul(&s1, &s1, &b->z);
    s2 = b->y; secp256k1_fe_normalize_weak(&s2);
    CHECK(secp256k1_fe_equal_var(&u1, &u2));
    CHECK(secp256k1_fe_equal_var(&s1, &s2));
 }
 static void random_fe(secp256k1_fe *x) {
    unsigned char bin[32];
    do {
        secp256k1_testrand256(bin);
        if (secp256k1_fe_set_b32_limit(x, bin)) {
            return;
        }
    } while(1);
 }
 static void random_fe_non_zero(secp256k1_fe *nz) {
    int tries = 10;
    while (--tries >= 0) {
        random_fe(nz);
        secp256k1_fe_normalize(nz);
        if (!secp256k1_fe_is_zero(nz)) {
            break;
        }
    }
    /* Infinitesimal probability of spurious failure here */
    CHECK(tries >= 0);
 }
 /** END stolen from tests.c */
 static uint32_t num_cores = 1;
 static uint32_t this_core = 0;
@ -219,14 +169,14 @@ static void test_exhaustive_ecmult(const secp256k1_ge *group, const secp256k1_ge
                /* Test secp256k1_ecmult_const_xonly with all curve X coordinates, and xd=NULL. */
                ret = secp256k1_ecmult_const_xonly(&tmpf, &group[i].x, NULL, &ng, 0);
                CHECK(ret);
-                CHECK(secp256k1_fe_equal_var(&tmpf, &group[(i * j) % EXHAUSTIVE_TEST_ORDER].x));
+                CHECK(secp256k1_fe_equal(&tmpf, &group[(i * j) % EXHAUSTIVE_TEST_ORDER].x));
                /* Test secp256k1_ecmult_const_xonly with all curve X coordinates, with random xd. */
                random_fe_non_zero(&xd);
                secp256k1_fe_mul(&xn, &xd, &group[i].x);
                ret = secp256k1_ecmult_const_xonly(&tmpf, &xn, &xd, &ng, 0);
                CHECK(ret);
-                CHECK(secp256k1_fe_equal_var(&tmpf, &group[(i * j) % EXHAUSTIVE_TEST_ORDER].x));
+                CHECK(secp256k1_fe_equal(&tmpf, &group[(i * j) % EXHAUSTIVE_TEST_ORDER].x));
            }
        }
    }
@ -475,8 +425,8 @@ int main(int argc, char** argv) {
                CHECK(group[i].infinity == 0);
                CHECK(generated.infinity == 0);
-                CHECK(secp256k1_fe_equal_var(&generated.x, &group[i].x));
+                CHECK(secp256k1_fe_equal(&generated.x, &group[i].x));
-                CHECK(secp256k1_fe_equal_var(&generated.y, &group[i].y));
+                CHECK(secp256k1_fe_equal(&generated.y, &group[i].y));
            }
        }
--- a/src/testutil.h
+++ b/src/testutil.h
@ -0,0 +1,55 @@
 /***********************************************************************
 * Distributed under the MIT software license, see the accompanying    *
 * file COPYING or https://www.opensource.org/licenses/mit-license.php.*
 ***********************************************************************/
 #ifndef SECP256K1_TESTUTIL_H
 #define SECP256K1_TESTUTIL_H
 #include "field.h"
 #include "testrand.h"
 #include "util.h"
 static void random_fe(secp256k1_fe *x) {
    unsigned char bin[32];
    do {
        secp256k1_testrand256(bin);
        if (secp256k1_fe_set_b32_limit(x, bin)) {
            return;
        }
    } while(1);
 }
 static void random_fe_non_zero(secp256k1_fe *nz) {
    do {
        random_fe(nz);
    } while (secp256k1_fe_is_zero(nz));
 }
 static void ge_equals_ge(const secp256k1_ge *a, const secp256k1_ge *b) {
    CHECK(a->infinity == b->infinity);
    if (a->infinity) {
        return;
    }
    CHECK(secp256k1_fe_equal(&a->x, &b->x));
    CHECK(secp256k1_fe_equal(&a->y, &b->y));
 }
 static void ge_equals_gej(const secp256k1_ge *a, const secp256k1_gej *b) {
    secp256k1_fe z2s;
    secp256k1_fe u1, u2, s1, s2;
    CHECK(a->infinity == b->infinity);
    if (a->infinity) {
        return;
    }
    /* Check a.x * b.z^2 == b.x && a.y * b.z^3 == b.y, to avoid inverses. */
    secp256k1_fe_sqr(&z2s, &b->z);
    secp256k1_fe_mul(&u1, &a->x, &z2s);
    u2 = b->x;
    secp256k1_fe_mul(&s1, &a->y, &z2s); secp256k1_fe_mul(&s1, &s1, &b->z);
    s2 = b->y;
    CHECK(secp256k1_fe_equal(&u1, &u2));
    CHECK(secp256k1_fe_equal(&s1, &s2));
 }
 #endif /* SECP256K1_TESTUTIL_H */